pax_global_header00006660000000000000000000000064151641207270014517gustar00rootroot0000000000000052 comment=badedeb24d331876f651f26ee033d5e266dabb8c box-debug/000077500000000000000000000000001516412072700127375ustar00rootroot00000000000000box-debug/.github/000077500000000000000000000000001516412072700142775ustar00rootroot00000000000000box-debug/.github/workflows/000077500000000000000000000000001516412072700163345ustar00rootroot00000000000000box-debug/.github/workflows/debug.yml000066400000000000000000000160721516412072700201530ustar00rootroot00000000000000name: debug on: workflow_dispatch: push: paths-ignore: - "README.md" - "CHANGELOG.md" branches: - master jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4.1.0 with: fetch-depth: 0 - name: Update Module.prop run: | dos2unix module.prop || true VERSION=$(grep -oP 'version=\K[^ ]+' module.prop | tr -d '\r') sed -i "s/$VERSION/$VERSION($(git log --oneline -n 1 | awk '{print $1}'))/g" module.prop sed -i "s/versionCode=.*/versionCode=$(date +%Y%m%d)/g" module.prop - name: Get Version id: get_version run: | VERSION=$(grep -oP 'version=\K[^ ]+' module.prop | tr -d '\r') echo "version=$VERSION" >> "$GITHUB_OUTPUT" - name: Generate Asset run: | sudo mkdir -p /box sudo cp -r --parents $(find ./ -type f ! -path './.git/*' ! -name 'CHANGELOG.md' ! -name 'update.json' ! -name 'build.sh' ! -path './.github/*' ! -path './docs/*' ! -name 'LICENSE') /box/ - name: Upload Debug Asset => (box_${{ steps.get_version.outputs.version }}) uses: actions/upload-artifact@v4 with: name: "box_${{ steps.get_version.outputs.version }}" path: /box/ prerelease: runs-on: ubuntu-latest permissions: contents: write needs: - build if: success() steps: - name: Checkout uses: actions/checkout@v4.1.0 with: fetch-depth: 0 - name: Get Version Info id: get_version run: | VERSION=$(grep -oP 'version=\K[^ ]+' module.prop | tr -d '\r') COMMIT_HASH=$(git log -1 --pretty=format:"%h") COMMIT_DATE=$(git log -1 --pretty=format:"%ad" --date=short) COMMIT_MSG=$(git log -1 --pretty=format:"%B") FULL_VERSION="${VERSION}(${COMMIT_HASH})" ARTIFACT_NAME="box_${FULL_VERSION}" echo "version=$FULL_VERSION" >> "$GITHUB_OUTPUT" echo "artifact_name=$ARTIFACT_NAME" >> "$GITHUB_OUTPUT" echo "commit_hash=$COMMIT_HASH" >> "$GITHUB_OUTPUT" echo "commit_date=$COMMIT_DATE" >> "$GITHUB_OUTPUT" { echo 'commit_msg<> "$GITHUB_OUTPUT" - name: Download Artifact uses: actions/download-artifact@v4 with: name: "${{ steps.get_version.outputs.artifact_name }}" path: ./artifact - name: Create ZIP Package run: | cd artifact zip -r "../${{ steps.get_version.outputs.artifact_name }}.zip" . cd .. - name: Delete Current Release Assets uses: mknejp/delete-release-assets@v1 with: token: ${{ secrets.GITHUB_TOKEN }} tag: debug fail-if-no-assets: false fail-if-no-release: false assets: '*' - name: Update Tag to Current Commit uses: richardsimko/update-tag@v1 with: tag_name: debug env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload Prerelease uses: softprops/action-gh-release@v1 with: tag_name: debug name: "Debug Build - ${{ steps.get_version.outputs.version }}" body: | ## 📦 调试构建 **版本:** ${{ steps.get_version.outputs.version }} **提交:** ${{ steps.get_version.outputs.commit_hash }} **日期:** ${{ steps.get_version.outputs.commit_date }} ### 提交信息 ${{ steps.get_version.outputs.commit_msg }} --- ⚠️ 这是预发布版本，用于测试和调试。 files: ${{ steps.get_version.outputs.artifact_name }}.zip prerelease: true draft: false telegram-upload: runs-on: ubuntu-latest permissions: contents: read needs: - prerelease if: success() steps: - uses: actions/checkout@v4.1.0 with: fetch-depth: 0 - name: Get Version Info id: get_version run: | VERSION=$(grep -oP 'version=\K[^ ]+' module.prop | tr -d '\r') COMMIT_HASH=$(git log -1 --pretty=format:"%h") COMMIT_DATE=$(git log -1 --pretty=format:"%ad" --date=short) echo "version=$VERSION" >> "$GITHUB_OUTPUT" echo "commit_hash=$COMMIT_HASH" >> "$GITHUB_OUTPUT" echo "commit_date=$COMMIT_DATE" >> "$GITHUB_OUTPUT" echo "tag_name=debug" >> "$GITHUB_OUTPUT" - name: Get Commit Message id: commit_info run: | COMMIT_MSG=$(git log -1 --pretty=format:"%B") # Escape HTML special characters for Telegram HTML parse mode # Convert backticks to tags for better Telegram display COMMIT_MSG_ESCAPED=$(echo "$COMMIT_MSG" | sed 's/&/\&/g; s//\>/g; s/`\([^`]*\)`/\1<\/code>/g') { echo 'commit_msg<> "$GITHUB_OUTPUT" - name: Download Release Asset env: GITHUB_TOKEN: ${{ github.token }} run: | # Get release info RELEASE_INFO=$(curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \ "https://api.github.com/repos/${{ github.repository }}/releases/tags/${{ steps.get_version.outputs.tag_name }}") # Get download URL for the zip file DOWNLOAD_URL=$(echo "$RELEASE_INFO" | jq -r '.assets[0].browser_download_url') ASSET_NAME=$(echo "$RELEASE_INFO" | jq -r '.assets[0].name') if [ -z "$DOWNLOAD_URL" ] || [ "$DOWNLOAD_URL" = "null" ]; then echo "Release asset not found for tag: ${{ steps.get_version.outputs.tag_name }}" exit 1 fi # Download the release asset curl -sL -o "$ASSET_NAME" "$DOWNLOAD_URL" echo "asset_name=$ASSET_NAME" >> "$GITHUB_OUTPUT" id: download_asset - name: Send to Telegram env: TG_BOT_TOKEN: ${{ secrets.TG_BOT_TOKEN }} TG_CHAT_ID: ${{ secrets.TG_CHAT_ID }} run: | MESSAGE="📦 Box 模块自动构建 版本: ${{ steps.get_version.outputs.version }} 提交: ${{ steps.get_version.outputs.commit_hash }} 日期: ${{ steps.get_version.outputs.commit_date }} 内容: ${{ steps.commit_info.outputs.commit_msg }} 仓库地址 | Release 详情 #模块更新" curl -sS -f -F "chat_id=$TG_CHAT_ID" \ -F "document=@${{ steps.download_asset.outputs.asset_name }}" \ -F "caption=$MESSAGE" \ -F "parse_mode=HTML" \ "https://api.telegram.org/bot$TG_BOT_TOKEN/sendDocument" box-debug/.github/workflows/release.yml000077500000000000000000000074031516412072700205060ustar00rootroot00000000000000name: release on: workflow_dispatch: inputs: tag: description: '发布标签' required: true branch: description: '目标分支（用于版本文件更新）' required: true changelog: description: '更新日志内容 (用 | 分隔多个项目)' required: true type: string jobs: build: runs-on: ubuntu-latest steps: # 1. Checkout repository - uses: actions/checkout@v4 with: fetch-depth: 0 token: ${{ secrets.GITHUB_TOKEN }} # 2. Generate version date - name: Get Version id: get_version run: echo "date=$(date +%Y%m%d)" >> "$GITHUB_OUTPUT" # 3. Update update.json, module.prop, and CHANGELOG.md - name: Update files run: | VERSION="${{ github.event.inputs.tag }}" DATE_NUM="${{ steps.get_version.outputs.date }}" DATE_HUMAN=$(date +%d-%m-%Y) CHANGELOG="${{ github.event.inputs.changelog }}" dos2unix module.prop || true # update.json cat > update.json < CHANGELOG.md echo "" >> CHANGELOG.md fi { echo "#### Changelog $VERSION - $DATE_HUMAN" echo "$CHANGELOG" | tr '|' '\n' | while IFS= read -r line; do trimmed_line=$(echo "$line" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//') if [ -n "$trimmed_line" ]; then echo "- $trimmed_line" fi done echo "" cat CHANGELOG.md } > CHANGELOG.tmp && mv CHANGELOG.tmp CHANGELOG.md # 4. Format changelog for GitHub Release - name: Format changelog for release id: format_changelog run: | FORMATTED=$(echo "${{ github.event.inputs.changelog }}" | tr '|' '\n' | while IFS= read -r line; do trimmed_line=$(echo "$line" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//') if [ -n "$trimmed_line" ]; then echo "- $trimmed_line" fi done) echo "formatted_changelog<> $GITHUB_OUTPUT echo "$FORMATTED" >> $GITHUB_OUTPUT echo "EOF" >> $GITHUB_OUTPUT # 5. Commit and push changes - name: Commit and push changes run: | git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" git add update.json module.prop CHANGELOG.md git commit -m "${{ github.event.inputs.tag }}" || echo "No changes to commit" git push https://github-actions:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git HEAD:${{ github.event.inputs.branch }} --force # 6. Run build script - name: Run build.sh run: | chmod +x build.sh ./build.sh # 7. Create GitHub Release - name: Create GitHub Release uses: softprops/action-gh-release@v1 with: tag_name: ${{ github.event.inputs.tag }} files: box-*.zip generate_release_notes: true body: | #### Changelog ${{ github.event.inputs.tag }} ${{ steps.format_changelog.outputs.formatted_changelog }} box-debug/CHANGELOG.md000066400000000000000000000007211516412072700145500ustar00rootroot00000000000000#### Changelog 1.2.6 - 06-11-2025 - 优化 WebUI 不再是固定 dashboard 目录 - 为模块安装新增删除更新残留选项，新增超时自动选择 - 为更新订阅新增自动修改 mihomo 的 proxy-providers 配置内容 #### Changelog 1.2.5 - 02-10-2025 - 优化安装脚本优化 service 的 singbox 部分内容 - 增加 GitHub Token 密钥填写 - 精简优化默认 mihomo 配置 #### Changelog 1.2.4 - 23-08-2025 - 优化与重构 # Changelog box-debug/LICENSE000066400000000000000000001045151516412072700137520ustar00rootroot00000000000000 GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The GNU General Public License is a free, copyleft license for software and other kinds of works. The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things. To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others. For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it. For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions. Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users. Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free. The precise terms and conditions for copying, distribution and modification follow. TERMS AND CONDITIONS 0. Definitions. "This License" refers to version 3 of the GNU General Public License. "Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks. "The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you". "Licensees" and "recipients" may be individuals or organizations. To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work. A "covered work" means either the unmodified Program or a work based on the Program. To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well. To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying. An interactive user interface displays "Appropriate Legal Notices" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion. 1. Source Code. The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work. A "Standard Interface" means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language. The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it. The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work. The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source. The Corresponding Source for a work in source code form is that same work. 2. Basic Permissions. All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law. You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you. Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary. 3. Protecting Users' Legal Rights From Anti-Circumvention Law. No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures. When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures. 4. Conveying Verbatim Copies. You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program. You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee. 5. Conveying Modified Source Versions. You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions: a) The work must carry prominent notices stating that you modified it, and giving a relevant date. b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices". c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it. d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so. A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. 6. Conveying Non-Source Forms. You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange. b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge. c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b. d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements. e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d. A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work. A "User Product" is either (1) a "consumer product", which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, "normally used" refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product. "Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM). The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network. Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying. 7. Additional Terms. "Additional permissions" are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions. When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission. Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms: a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or d) Limiting the use for publicity purposes of names of licensors or authors of the material; or e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors. All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying. If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms. Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way. 8. Termination. You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11). However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation. Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice. Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10. 9. Acceptance Not Required for Having Copies. You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so. 10. Automatic Licensing of Downstream Recipients. Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License. An "entity transaction" is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts. You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it. 11. Patents. A "contributor" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's "contributor version". A contributor's "essential patent claims" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, "control" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License. Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version. In the following three paragraphs, a "patent license" is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To "grant" such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party. If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. "Knowingly relying" means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid. If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it. A patent license is "discriminatory" if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007. Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law. 12. No Surrender of Others' Freedom. If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program. 13. Use with the GNU Affero General Public License. Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such. 14. Revised Versions of this License. The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation. If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program. Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version. 15. Disclaimer of Warranty. THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 16. Limitation of Liability. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 17. Interpretation of Sections 15 and 16. If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . Also add information on how to contact you by electronic and paper mail. If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode: Copyright (C) This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an "about box". You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see . The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read . box-debug/META-INF/000077500000000000000000000000001516412072700140775ustar00rootroot00000000000000box-debug/META-INF/com/000077500000000000000000000000001516412072700146555ustar00rootroot00000000000000box-debug/META-INF/com/google/000077500000000000000000000000001516412072700161315ustar00rootroot00000000000000box-debug/META-INF/com/google/android/000077500000000000000000000000001516412072700175515ustar00rootroot00000000000000box-debug/META-INF/com/google/android/update-binary000077500000000000000000000011441516412072700222430ustar00rootroot00000000000000#!/sbin/sh ################# # Initialization ################# umask 022 # echo before loading util_functions ui_print() { echo "$1"; } require_new_magisk() { ui_print "*******************************" ui_print " Please install Magisk v20.4+! " ui_print "*******************************" exit 1 } ######################### # Load util_functions.sh ######################### OUTFD=$2 ZIPFILE=$3 mount /data 2>/dev/null [ -f /data/adb/magisk/util_functions.sh ] && { . /data/adb/magisk/util_functions.sh [ $MAGISK_VER_CODE -lt 20400 ] && require_new_magisk install_module exit 0 } box-debug/META-INF/com/google/android/updater-script000077500000000000000000000000101516412072700224340ustar00rootroot00000000000000#MAGISK box-debug/README.md000066400000000000000000000036161516412072700142240ustar00rootroot00000000000000# Box for Root `Box for Root` 是一个面向 Android Root 环境（Magisk / KernelSU / APatch）的透明代理工具箱模块。 项目深受以下仓库启发并在其基础上持续演进： - [CHIZI-0618/box4magisk](https://github.com/CHIZI-0618/box4magisk) - [taamarin/box_for_magisk](https://github.com/taamarin/box_for_magisk) ## 项目定位 本仓库主要提供： - 统一的代理核心运行管理（mihomo / sing-box / xray / v2fly / hysteria） - 多网络模式下的透明代理规则编排（TProxy / Redirect / Tun / Mixed / Enhance） - 订阅、Geo 资源、核心二进制与 WebUI 的统一维护脚本 - 适配 Android Root 生态的模块化目录与服务生命周期管理 ## 主要目录 模块工作目录：`/data/adb/box/` ```text /data/adb/box/ ├── bin/ # 代理核心与工具二进制 ├── mihomo/ # mihomo 配置目录 ├── sing-box/ # sing-box 配置目录 ├── xray/ # xray 配置目录 ├── v2fly/ # v2fly 配置目录 ├── hysteria/ # hysteria 配置目录 ├── scripts/ # 核心脚本 │ ├── box.service # 服务生命周期管理 │ ├── box.iptables # 透明代理规则管理 │ └── box.tool # 更新与维护工具集 ├── run/ # 运行时状态与日志 └── settings.ini # 全局配置文件 ``` ## 核心脚本 - `box.service`: 启停、重启、状态与定时任务控制 - `box.iptables`: 透明代理规则启用、重建、清理 - `box.tool`: 订阅更新、Geo 更新、核心更新、配置检查、WebUI 相关维护 ## 文档与社区 - Wiki: - 更新日志: [CHANGELOG.md](./CHANGELOG.md) - 配套 APP / 通知频道: ## 致谢 感谢开源社区与上述项目作者提供的设计思路与实现参考。 box-debug/action.sh000066400000000000000000000012171516412072700145510ustar00rootroot00000000000000#!/system/bin/sh # 变量定义 box_dir="/data/adb/box" box_run="${box_dir}/run" box_pid="${box_run}/box.pid" run_as_su() { su -c "$1" } stop_service() { echo "服务正在关闭..." run_as_su "${box_dir}/scripts/box.iptables disable" run_as_su "${box_dir}/scripts/box.service stop" } start_service() { echo "服务正在启动，请稍候..." run_as_su "${box_dir}/scripts/box.service start" run_as_su "${box_dir}/scripts/box.iptables enable" } if [ -f "${box_pid}" ]; then PID=$(cat "${box_pid}") if [ -e "/proc/${PID}" ]; then stop_service else start_service fi else start_service fibox-debug/box/000077500000000000000000000000001516412072700135275ustar00rootroot00000000000000box-debug/box/ap.list.cfg000066400000000000000000000005441516412072700155650ustar00rootroot00000000000000# Allow access for network interfaces with the following prefixes: ap+, wlan+, rndis+, swlan+, ncm+, and eth+ # allow allow ap+ allow wlan+ allow rndis+ allow swlan+ allow ncm+ allow eth+ # -----------------🌼🌼----------------------- # # Ignore network interface # Ignore # ignore wlan0 # ignore swlan0 # ignore wlan+box-debug/box/bin/000077500000000000000000000000001516412072700142775ustar00rootroot00000000000000box-debug/box/bin/.bin000077500000000000000000000000001516412072700150410ustar00rootroot00000000000000box-debug/box/crontab.cfg000066400000000000000000000000251516412072700156350ustar00rootroot00000000000000# cron tasks for rootbox-debug/box/gid.list.cfg000066400000000000000000000002261516412072700157250ustar00rootroot00000000000000# GID (用户组ID) 配置文件 # # --- 格式说明 --- # # 按 GID (用户组ID) 匹配 # 每行一个 GID 数字 # # 示例: # 10450 # 99910450 box-debug/box/mihomo/000077500000000000000000000000001516412072700150175ustar00rootroot00000000000000box-debug/box/mihomo/config.yaml000066400000000000000000000103451516412072700171530ustar00rootroot00000000000000# 此为精简配置，如需更为详细的配置，可参考 https://wiki.metacubex.one/config # 如不会配置，也可自行寻找懒人配置，例如(Surfing 模块配置)：https://raw.githubusercontent.com/GitMetaio/Surfing/refs/heads/main/box_bll/clash/config.yaml proxy-providers: proxy1: type: http url: "填写订阅链接" path: ./proxy_provider/proxy1.yaml interval: 86400 health-check: enable: true url: https://cp.cloudflare.com interval: 300 timeout: 1000 tolerance: 100 # 多订阅按照下面照葫芦画瓢即可 # proxy2: # type: http # url: "填写订阅链接" # path: ./proxy_provider/proxy2.yaml # interval: 86400 # health-check: # enable: true # url: https://cp.cloudflare.com # interval: 300 # timeout: 1000 # tolerance: 100 mixed-port: 7890 redir-port: 9797 tproxy-port: 9898 mode: Rule bind-address: '*' ipv6: true allow-lan: true unified-delay: false tcp-concurrent: true log-level: error find-process-mode: always # global-client-fingerprint: random external-controller: 0.0.0.0:9090 external-ui: ./dashboard profile: store-selected: true store-fake-ip: true sniffer: enable: true override-destination: false sniff: HTTP: ports: [80, 8080-8880] override-destination: true TLS: ports: [443, 8443] QUIC: ports: [443, 8443] tun: enable: true device: meta stack: gvisor dns-hijack: [any:53, tcp://any:53] udp-timeout: 300 auto-route: true auto-redirect: false auto-detect-interface: true strict-route: false dns: enable: true ipv6: true listen: 0.0.0.0:1053 enhanced-mode: fake-ip fake-ip-range: 198.18.0.1/16 fake-ip-filter: - "rule-set:Fake-IP-Filter" proxy-server-nameserver: - 223.5.5.5 nameserver-policy: "rule-set:cn_domain": - 223.5.5.5 nameserver: - 8.8.8.8 proxies: - {name: DNS_Hijack, type: dns} proxy-groups: - name: 国外代理 type: select include-all: true exclude-type: "dns" icon: https://ghfast.top/raw.githubusercontent.com/Koolson/Qure/refs/heads/master/IconSet/Color/Proxy.png - name: 国内直连 type: select proxies: [DIRECT] include-all: true exclude-type: "dns" icon: https://ghfast.top/raw.githubusercontent.com/Koolson/Qure/refs/heads/master/IconSet/Color/China.png - name: 漏网之鱼 type: select proxies: [国外代理,国内直连] icon: https://ghfast.top/raw.githubusercontent.com/Koolson/Qure/refs/heads/master/IconSet/Color/Final.png rule-providers: Fake-IP-Filter: type: http behavior: domain format: mrs interval: 86400 path: ./rule_provider/Fake-IP-Filter.mrs url: "https://ghfast.top/github.com/DustinWin/ruleset_geodata/raw/refs/heads/mihomo-ruleset/fakeip-filter.mrs" proxy: DIRECT proxy_domain: type: http behavior: domain format: mrs interval: 86400 path: ./rule_provider/proxy_domain.mrs url: "https://ghfast.top/github.com/DustinWin/ruleset_geodata/raw/refs/heads/mihomo-ruleset/proxy.mrs" proxy: DIRECT cn_ip: type: http behavior: ipcidr format: mrs interval: 86400 path: ./rule_provider/cn_ip.mrs url: "https://ghfast.top/github.com/MetaCubeX/meta-rules-dat/raw/refs/heads/meta/geo/geoip/cn.mrs" proxy: DIRECT private_ip: type: http behavior: ipcidr format: mrs interval: 86400 path: ./rule_provider/private_ip.mrs url: "https://ghfast.top/github.com/MetaCubeX/meta-rules-dat/raw/refs/heads/meta/geo/geoip/private.mrs" proxy: DIRECT cn_domain: type: http behavior: domain format: mrs interval: 86400 path: ./rule_provider/cn_domain.mrs url: "https://ghfast.top/github.com/MetaCubeX/meta-rules-dat/raw/refs/heads/meta/geo/geosite/cn.mrs" proxy: DIRECT private_domain: type: http behavior: domain format: mrs interval: 86400 path: ./rule_provider/private_domain.mrs url: "https://ghfast.top/github.com/MetaCubeX/meta-rules-dat/raw/refs/heads/meta/geo/geosite/private.mrs" proxy: DIRECT rules: - DST-PORT,53,DNS_Hijack - RULE-SET,proxy_domain,国外代理 - OR,((RULE-SET,cn_ip),(RULE-SET,cn_domain),(RULE-SET,private_ip),(RULE-SET,private_domain)),国内直连 - MATCH,漏网之鱼box-debug/box/package.list.cfg000066400000000000000000000004101516412072700165500ustar00rootroot00000000000000# 应用包名配置文件 # # --- 格式说明 --- # # 按用户 ID 匹配特定用户空间中的应用 # 格式: <用户ID>:<包名> # # 示例: # 999:com.example.app (Work Profile) # 0:com.example.app (主空间) # 10:com.example.app (用户10的应用)box-debug/box/scripts/000077500000000000000000000000001516412072700152165ustar00rootroot00000000000000box-debug/box/scripts/box.inotify000077500000000000000000000017411516412072700174170ustar00rootroot00000000000000#!/system/bin/sh scripts_dir="${0%/*}" service_path="${scripts_dir}/box.service" iptables_path="${scripts_dir}/box.iptables" data_box="/data/adb/box" run_path="/data/adb/box/run" file_settings="/data/adb/box/settings.ini" now=$(date +"%I:%M %p") events="$1" monitor_dir="$2" monitor_file="$3" service_control() { if [ "${monitor_file}" = "disable" ]; then if [ "${events}" = "d" ]; then "${service_path}" start > "${run_path}/inotify.log" 2>&1 && "${iptables_path}" enable >> "${run_path}/inotify.log" 2>&1 elif [ "${events}" = "n" ]; then "${iptables_path}" disable >> "${run_path}/inotify.log" 2>&1 && "${service_path}" stop >> "${run_path}/inotify.log" 2>&1 fi fi } mkdir -p "${run_path}" >/dev/null 2>&1 || true if [ -f "${file_settings}" ] && [ -r "${file_settings}" ] && [ -s "${file_settings}" ]; then service_control else echo "${now} [error] file /data/adb/box/settings.ini file not found" > "${run_path}/inotify_report.log" exit 1 fibox-debug/box/scripts/box.iptables000077500000000000000000001634341516412072700175510ustar00rootroot00000000000000#!/system/bin/sh scripts_dir="${0%/*}" source /data/adb/box/settings.ini runtime_iptables_env="${box_run_state}/runtime.iptables.env" fwmark="16777216/16777216" table="2024" pref="100" # 使用 iptables 规则禁用或启用 QUIC。注意，这可能导致部分网站无法访问。 quic=${quic:-"enable"} mihomo_dns_forward=${mihomo_dns_forward:-"enable"} proxy_tcp=${proxy_tcp:-"true"} proxy_udp=${proxy_udp:-"true"} dns_hijack_tcp=${dns_hijack_tcp:-"true"} dns_hijack_udp=${dns_hijack_udp:-"true"} fake_ip_range="" fake_ip6_range="" # ex: 7.1.1 buildVersion=$(getprop ro.build.version.release) minBuildVersion="11" IPV="iptables" # Default IP6V="ip6tables" # Default # ex: 7.1.1 -> 7 buildVersionMajor=${buildVersion%%.*} if [ "$buildVersionMajor" -ge "$minBuildVersion" ]; then IPV="iptables -w 100" IP6V="ip6tables -w 100" fi chain_exists() { local table_name="$1" local chain_name="$2" ${iptables} -t "${table_name}" -L "${chain_name}" >/dev/null 2>&1 } ensure_chain() { local table_name="$1" local chain_name="$2" ${iptables} -t "${table_name}" -N "${chain_name}" >/dev/null 2>&1 || true ${iptables} -t "${table_name}" -F "${chain_name}" >/dev/null 2>&1 || true } ensure_jump() { local table_name="$1" local parent_chain="$2" local target_chain="$3" if ! ${iptables} -t "${table_name}" -C "${parent_chain}" -j "${target_chain}" >/dev/null 2>&1; then ${iptables} -t "${table_name}" -I "${parent_chain}" -j "${target_chain}" fi } del_jump_if_exists() { local table_name="$1" local parent_chain="$2" local target_chain="$3" if ${iptables} -t "${table_name}" -C "${parent_chain}" -j "${target_chain}" >/dev/null 2>&1; then ${iptables} -t "${table_name}" -D "${parent_chain}" -j "${target_chain}" >/dev/null 2>&1 || true fi } del_jump_silent() { local table_name="$1" local parent_chain="$2" local target_chain="$3" ${iptables} -t "${table_name}" -D "${parent_chain}" -j "${target_chain}" >/dev/null 2>&1 || true } cleanup_chain() { local table_name="$1" local chain_name="$2" if chain_exists "${table_name}" "${chain_name}"; then ${iptables} -t "${table_name}" -F "${chain_name}" >/dev/null 2>&1 || true ${iptables} -t "${table_name}" -X "${chain_name}" >/dev/null 2>&1 || true fi } ensure_rule_append() { local table_name="$1" local chain_name="$2" shift 2 # 对自定义链（每次启动都会 flush）跳过 -C 检查，加速启动。 # 注意：不要对内置链跳过检查，否则会导致规则重复累积。 if is_box_custom_chain "${chain_name}"; then ${iptables} -t "${table_name}" -A "${chain_name}" "$@" >/dev/null 2>&1 || true return 0 fi if ! ${iptables} -t "${table_name}" -C "${chain_name}" "$@" >/dev/null 2>&1; then ${iptables} -t "${table_name}" -A "${chain_name}" "$@" fi } ensure_rule_insert() { local table_name="$1" local chain_name="$2" shift 2 # 对自定义链（每次启动都会 flush）跳过 -C 检查，加速启动。 if is_box_custom_chain "${chain_name}"; then ${iptables} -t "${table_name}" -I "${chain_name}" "$@" >/dev/null 2>&1 || true return 0 fi if ! ${iptables} -t "${table_name}" -C "${chain_name}" "$@" >/dev/null 2>&1; then ${iptables} -t "${table_name}" -I "${chain_name}" "$@" fi } is_box_custom_chain() { local chain_name="$1" case "${chain_name}" in BOX_*|DIVERT|LOCAL_IP_V4|LOCAL_IP_V6|NAT_DNS_HIJACK|NAT_DNS_HIJACK6|MIHOMO_DNS_EXTERNAL|MIHOMO_DNS_LOCAL|AP_* ) return 0 ;; *) return 1 ;; esac } del_rule_if_exists() { local table_name="$1" local chain_name="$2" shift 2 if ${iptables} -t "${table_name}" -C "${chain_name}" "$@" >/dev/null 2>&1; then ${iptables} -t "${table_name}" -D "${chain_name}" "$@" >/dev/null 2>&1 || true fi } del_rule_silent() { local table_name="$1" local chain_name="$2" shift 2 ${iptables} -t "${table_name}" -D "${chain_name}" "$@" >/dev/null 2>&1 || true } cleanup_chain_fast() { local table_name="$1" local chain_name="$2" ${iptables} -t "${table_name}" -F "${chain_name}" >/dev/null 2>&1 || true ${iptables} -t "${table_name}" -X "${chain_name}" >/dev/null 2>&1 || true } ip_rule_exists() { local ip_cmd="$1" local fwmark="$2" local table_id="$3" local pref_id="$4" ${ip_cmd} rule show pref "${pref_id}" 2>/dev/null | busybox grep -q "fwmark ${fwmark}.*lookup ${table_id}" } ensure_ip_rule() { local ip_cmd="$1" local fwmark="$2" local table_id="$3" local pref_id="$4" if ! ip_rule_exists "${ip_cmd}" "${fwmark}" "${table_id}" "${pref_id}"; then ${ip_cmd} rule add fwmark "${fwmark}" table "${table_id}" pref "${pref_id}" fi } del_ip_rule_if_exists() { local ip_cmd="$1" local fwmark="$2" local table_id="$3" local pref_id="$4" if ip_rule_exists "${ip_cmd}" "${fwmark}" "${table_id}" "${pref_id}"; then ${ip_cmd} rule del fwmark "${fwmark}" table "${table_id}" pref "${pref_id}" >/dev/null 2>&1 || true fi } ip_route_local_default_exists() { local ip_cmd="$1" local table_id="$2" ${ip_cmd} route show table "${table_id}" 2>/dev/null | busybox grep -q "^local default dev lo\b" } ensure_ip_route_local_default() { local ip_cmd="$1" local table_id="$2" if ! ip_route_local_default_exists "${ip_cmd}" "${table_id}"; then ${ip_cmd} route add local default dev lo table "${table_id}" fi } del_ip_route_local_default_if_exists() { local ip_cmd="$1" local table_id="$2" if ip_route_local_default_exists "${ip_cmd}" "${table_id}"; then ${ip_cmd} route del local default dev lo table "${table_id}" >/dev/null 2>&1 || true fi } runtime_save() { mkdir -p "${box_run}" >/dev/null 2>&1 || true { printf 'network_mode="%s"\n' "${network_mode}" printf 'bin_name="%s"\n' "${bin_name}" printf 'ipv6="%s"\n' "${ipv6}" printf 'dns_hijack_mode="%s"\n' "${dns_hijack_mode}" printf 'mihomo_dns_forward="%s"\n' "${mihomo_dns_forward}" printf 'quic="%s"\n' "${quic}" printf 'proxy_tcp="%s"\n' "${proxy_tcp}" printf 'proxy_udp="%s"\n' "${proxy_udp}" printf 'dns_hijack_tcp="%s"\n' "${dns_hijack_tcp}" printf 'dns_hijack_udp="%s"\n' "${dns_hijack_udp}" printf 'fwmark="%s"\n' "${fwmark}" printf 'table="%s"\n' "${table}" printf 'pref="%s"\n' "${pref}" printf 'tproxy_port="%s"\n' "${tproxy_port}" printf 'redir_port="%s"\n' "${redir_port}" printf 'mihomo_dns_port="%s"\n' "${mihomo_dns_port}" printf 'fake_ip_range="%s"\n' "${fake_ip_range}" printf 'fake_ip6_range="%s"\n' "${fake_ip6_range}" printf 'bypass_cn_ip="%s"\n' "${bypass_cn_ip}" printf 'bypass_cn_ip_v4="%s"\n' "${bypass_cn_ip_v4}" printf 'bypass_cn_ip_v6="%s"\n' "${bypass_cn_ip_v6}" printf 'box_user="%s"\n' "${box_user}" printf 'box_group="%s"\n' "${box_group}" } >"${runtime_iptables_env}" 2>/dev/null } runtime_load() { [ -f "${runtime_iptables_env}" ] || return 1 . "${runtime_iptables_env}" log Debug "已加载 runtime 快照: ${runtime_iptables_env}" return 0 } runtime_clear() { rm -f "${runtime_iptables_env}" >/dev/null 2>&1 || true log Debug "已清理 runtime 快照: ${runtime_iptables_env}" } cap_has_target() { local family="$1" local target="$2" local f if [ "${family}" = "6" ]; then f="/proc/net/ip6_tables_targets" else f="/proc/net/ip_tables_targets" fi [ -r "${f}" ] || return 1 busybox grep -qw "${target}" "${f}" } cap_has_match() { local family="$1" local match="$2" local f if [ "${family}" = "6" ]; then f="/proc/net/ip6_tables_matches" else f="/proc/net/ip_tables_matches" fi [ -r "${f}" ] || return 1 busybox grep -qw "${match}" "${f}" } probe_capabilities() { cap_tproxy4="false" cap_tproxy6="false" cap_socket_match="false" cap_ipset="false" cap_ip6_nat="false" cap_has_target 4 TPROXY && cap_tproxy4="true" cap_has_target 6 TPROXY && cap_tproxy6="true" # xt_socket (cap_has_match 4 socket || cap_has_match 6 socket) && cap_socket_match="true" command -v ipset >/dev/null 2>&1 && cap_ipset="true" ip6_nat_supported && cap_ip6_nat="true" log Debug "能力探测: TPROXY(v4=${cap_tproxy4}, v6=${cap_tproxy6}) socket_match=${cap_socket_match} ipset=${cap_ipset} ip6_nat=${cap_ip6_nat}" } log_context() { log Info "运行上下文: mode=${network_mode}, bin=${bin_name}, ipv6=${ipv6}, dns_hijack=${dns_hijack_mode}" log Info "运行上下文: ports(tproxy=${tproxy_port}, redir=${redir_port}, mihomo_dns=${mihomo_dns_port})" log Info "运行上下文: flags(proxy_tcp=${proxy_tcp}, proxy_udp=${proxy_udp}, dns_tcp=${dns_hijack_tcp}, dns_udp=${dns_hijack_udp}, quic=${quic})" log Info "运行上下文: cnip(total=${bypass_cn_ip}, v4=${bypass_cn_ip_v4}, v6=${bypass_cn_ip_v6})" log Info "运行上下文: mac_filter(enable=${mac_filter}, mode=${mac_mode}, macs_count=${#macs_list[@]})" if [ "${ap_list}" != "" ]; then log Debug "接口 allow: ${ap_list[*]}" fi if [ "${ignore_ap_list}" != "" ]; then log Debug "接口 ignore: ${ignore_ap_list[*]}" fi } log_capabilities() { log Info "能力: tproxy4=${cap_tproxy4}, tproxy6=${cap_tproxy6}, socket_match=${cap_socket_match}, ipset=${cap_ipset}, ip6_nat=${cap_ip6_nat}" } apply_capability_downgrades() { probe_capabilities local _old_mode="${network_mode}" local _old_dns="${dns_hijack_mode}" local _old_cn="${bypass_cn_ip}" if [[ "${network_mode}" == @(tproxy|enhance) ]] && [ "${cap_tproxy4}" != "true" ]; then log Warning "降级: 内核不支持 TPROXY, network_mode ${network_mode} -> redirect" network_mode="redirect" fi if [ "${dns_hijack_mode}" = "tproxy" ] && [ "${cap_tproxy4}" != "true" ]; then log Warning "降级: 内核不支持 TPROXY, dns_hijack_mode tproxy -> redirect" dns_hijack_mode="redirect" fi if [ "${bypass_cn_ip}" = "true" ] && [ "${cap_ipset}" != "true" ]; then log Warning "降级: ipset 不可用, bypass_cn_ip true -> false" bypass_cn_ip="false" bypass_cn_ip_v4="false" bypass_cn_ip_v6="false" fi [ "${_old_mode}" != "${network_mode}" ] && log Info "最终 network_mode=${network_mode}" [ "${_old_dns}" != "${dns_hijack_mode}" ] && log Info "最终 dns_hijack_mode=${dns_hijack_mode}" [ "${_old_cn}" != "${bypass_cn_ip}" ] && log Info "最终 bypass_cn_ip=${bypass_cn_ip}" log_capabilities } setup_nat_dns_hijack() { local chain_name="$1" local dns_port="$2" local family="$3" ensure_chain nat "${chain_name}" ensure_rule_insert nat "${chain_name}" -m owner --uid-owner "${box_user}" --gid-owner "${box_group}" -j RETURN if [ "${family}" = "4" ] && [ "${ignore_ap_list}" != "" ]; then for ignore in ${ignore_ap_list[@]} ; do ensure_rule_append nat "${chain_name}" -i "${ignore}" -j RETURN done fi ensure_rule_append nat "${chain_name}" -p tcp --dport 53 -j REDIRECT --to-ports "${dns_port}" ensure_rule_append nat "${chain_name}" -p udp --dport 53 -j REDIRECT --to-ports "${dns_port}" ensure_jump nat PREROUTING "${chain_name}" ensure_jump nat OUTPUT "${chain_name}" } case "${bin_name}" in "mihomo") mihomo_mode=$(busybox awk '!/^ *#/ && /mode: / { print $2;found=1; exit } END{ if(!found) print "rules" }' "${mihomo_config}" 2>/dev/null) mihomo_enhanced_mode=$(busybox awk '!/^ *#/ && /enhanced-mode: / { print $2;found=1; exit } END{ if(!found) print "fake-ip" }' "${mihomo_config}" 2>/dev/null) fake_ip_range=$(busybox awk '!/^ *#/ && /fake-ip-range:/ { print $2; found=1; exit } END { if (!found) print "198.18.0.1/16" }' "${mihomo_config}" 2>/dev/null) fake_ip6_range=$(busybox awk '!/^ *#/ && /fake-ip-range6:/ { print $2; found=1; exit } END { if (!found) print "fc00::/18" }' "${mihomo_config}" 2>/dev/null) mihomo_dns_port=$(sed -n '/^dns:/,/^[^ ]/p' "${mihomo_config}" | grep -E '^[^#]*listen:.*:[0-9]+' | grep -Eo '[0-9]+' | tail -n 1) mihomo_dns_port=${mihomo_dns_port:-1053} if [[ "${network_mode}" == @(mixed|tun) ]]; then tun_device=$(busybox awk '!/^ *#/ && /device: / { print $2;found=1; exit } END{ if(!found) print "meta" }' "${mihomo_config}" 2>/dev/null) fi ;; "sing-box") if [[ "${network_mode}" == @(mixed|tun) ]]; then tun_device=$(busybox grep -oE '"interface_name": "[^"]*' "${sing_config}" | busybox awk -F'"' '{print $4}' 2>/dev/null | head -n 1) if [ -z "$tun_device" ]; then tun_device="tun0" fi fi fake_ip_range=$(busybox awk -F'"' '/inet4_range/ {print $4}' "${sing_config}") fake_ip6_range=$(busybox awk -F'"' '/inet6_range/ {print $4}' "${sing_config}") ;; "hysteria") case "${network_mode}" in redirect|tproxy|enhance) # 支持的模式，无需操作 true ;; *) log Warning "$bin_name 不支持 network_mode: $network_mode，已切换回 TProxy" sed -i 's/\(network_mode=\)\"[^\"]*\"/\1"tproxy"/g' ${settings} ;; esac ;; "xray" | "v2fly") if [[ "${network_mode}" != "tproxy" ]]; then log Warning "$bin_name 不支持 network_mode: $network_mode，已切换回 TProxy" sed -i 's/\(network_mode=\)\"[^\"]*\"/\1"tproxy"/g' ${settings} fi ;; *) log Error "<${bin_name}> 未知内核。" exit 1 ;; esac box_etc() { case "${bin_name}" in mihomo) log Debug "增强模式: $mihomo_enhanced_mode, fake-ip 段: $fake_ip_range, fake-ip6 段: ${fake_ip6_range:-none}, DNS 端口: $mihomo_dns_port, 模式: $mihomo_mode" ;; sing-box) if [ -n "${fake_ip_range}" ] && [ "${bin_name}" = "sing-box" ]; then log Debug "fake-ip 段: ${fake_ip_range}, ${fake_ip6_range}" fi ;; *) true ;; esac if [[ "${network_mode}" == @(mixed|tun) ]]; then log Info "TUN 设备: ($tun_device)" fi } bin_alive() { local PID=$(<"${box_pid}" 2>/dev/null) if ! kill -0 "$PID" >/dev/null; then log Error "$(<"${box_run}/${bin_name}.log")" log Error "${bin_name} 服务未运行。" log Error "请检查 ${bin_name}.log 获取更多信息。" log Error "正在清理僵尸进程 $PID" for bin in "${bin_list[@]}"; do killall -15 "${bin}" >/dev/null 2>&1 || busybox pkill -15 "${bin}" >/dev/null 2>&1 done cleanup_iptables [ -f "${box_pid}" ] && rm -f "${box_pid}" return 1 else return 0 fi } probe_user_group() { if PID=$(busybox pidof ${bin_name}) ; then box_user=$(stat -c %U /proc/$PID) box_group=$(stat -c %G /proc/$PID) return 0 else IFS=':' read -r box_user box_group <<< "${box_user_group}" return 1 fi } disable_ipv6() { sysctl -w net.ipv4.ip_forward=1 sysctl -w net.ipv6.conf.all.forwarding=0 sysctl -w net.ipv6.conf.all.accept_ra=0 sysctl -w net.ipv6.conf.wlan0.accept_ra=0 sysctl -w net.ipv6.conf.all.disable_ipv6=1 sysctl -w net.ipv6.conf.default.disable_ipv6=1 sysctl -w net.ipv6.conf.wlan0.disable_ipv6=1 # 新增：彻底阻断 IPv6 ip -6 rule show pref "${pref}" 2>/dev/null | busybox grep -q "unreachable" || ip -6 rule add unreachable pref "${pref}" } >/dev/null 2>&1 ipv6_enable() { sysctl -w net.ipv4.ip_forward=1 sysctl -w net.ipv6.conf.all.forwarding=1 sysctl -w net.ipv6.conf.all.accept_ra=2 sysctl -w net.ipv6.conf.wlan0.accept_ra=2 sysctl -w net.ipv6.conf.all.disable_ipv6=0 sysctl -w net.ipv6.conf.default.disable_ipv6=0 sysctl -w net.ipv6.conf.wlan0.disable_ipv6=0 # 删除：彻底阻断 IPv6 ip -6 rule show pref "${pref}" 2>/dev/null | busybox grep -q "unreachable" && ip -6 rule del unreachable pref "${pref}" >/dev/null 2>&1 || true # 新增：阻止所有 IPv6 的 53 端口 UDP 出站流量，防止 IPv6 DNS 泄漏 iptables="$IP6V" && ensure_rule_append filter OUTPUT -p udp --destination-port 53 -j DROP } >/dev/null 2>&1 intranet=( 0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 192.88.99.0/24 192.168.0.0/16 198.51.100.0/24 203.0.113.0/24 224.0.0.0/4 240.0.0.0/4 255.0.0.0/4 255.255.255.0/24 255.255.255.255/32 ) # 100.0.0.0/8 的使用是中国电信运营商的错误，建议改回 100.64.0.0/10。 intranet+=($(ip -4 a | busybox awk '/inet/ {print $2}' | busybox grep -vE "^127.0.0.1")) intranet6=( ::/128 ::1/128 ::ffff:0:0/96 100::/64 64:ff9b::/96 2001::/32 2001:10::/28 2001:20::/28 2001:db8::/32 2002::/16 fc00::/7 fe80::/10 ff00::/8 ) intranet6+=($(ip -6 a | busybox awk '/inet6/ {print $2}' | busybox grep -vE "^fe80|^::1|^fd00")) # IPv6 NAT 支持探测 ip6_nat_supported() { ip6tables -t nat -L >/dev/null 2>&1 } # CN ipset 载入/清理 setup_cn_ipset() { [ "${bypass_cn_ip}" = "true" ] || { log Debug "CN 分流未启用"; return 0; } if ! command -v ipset >/dev/null 2>&1; then log Warning "ipset 不可用，跳过 CN 分流" return 1 fi # IPv4 if [ "${bypass_cn_ip_v4}" = "true" ] && [ -f "${cn_ip_file}" ]; then if { echo "create cnip hash:net family inet hashsize 8192 maxelem 65536 -exist" echo "flush cnip" awk '!/^[[:space:]]*#/ && NF > 0 {printf "add cnip %s\n", $0}' "${cn_ip_file}" } | ipset restore -exist 2>/dev/null; then log Info "已加载中国大陆 IPv4 段到 ipset: cnip" else log Warning "加载 cnip 失败" fi else log Debug "跳过 IPv4 ipset 载入（未启用或文件不存在）" fi # IPv6 if [ "${ipv6}" = "true" ]; then if [ "${bypass_cn_ip_v6}" = "true" ] && [ -f "${cn_ipv6_file}" ]; then if { echo "create cnip6 hash:net family inet6 hashsize 8192 maxelem 65536 -exist" echo "flush cnip6" awk '!/^[[:space:]]*#/ && NF > 0 {printf "add cnip6 %s\n", $0}' "${cn_ipv6_file}" } | ipset restore -exist 2>/dev/null; then log Info "已加载中国大陆 IPv6 段到 ipset: cnip6" else log Warning "加载 cnip6 失败" fi else log Debug "跳过 IPv6 ipset 载入（未启用或文件不存在）" fi fi } cleanup_cn_ipset() { command -v ipset >/dev/null 2>&1 || return 0 ipset flush cnip 2>/dev/null || true ipset flush cnip6 2>/dev/null || true } probe_tun_device() { busybox ifconfig | grep -q "${tun_device}" || return 1 } forward() { local action=$1 # ${iptables} -t nat "${action}" POSTROUTING -o ${tun_device} -j MASQUERADE if [ "${action}" = "-D" ]; then del_rule_if_exists filter FORWARD -i "${tun_device}" -j ACCEPT del_rule_if_exists filter FORWARD -o "${tun_device}" -j ACCEPT else ensure_rule_insert filter FORWARD -i "${tun_device}" -j ACCEPT ensure_rule_insert filter FORWARD -o "${tun_device}" -j ACCEPT fi sysctl -w net.ipv4.ip_forward=1 sysctl -w net.ipv4.conf.default.rp_filter=2 sysctl -w net.ipv4.conf.all.rp_filter=2 } >/dev/null 2>&1 start_redirect() { # IPv6: 若当前在 ip6tables 环境，且配置为 redirect，并且内核支持 IPv6 NAT，则创建 NAT_DNS_HIJACK6 if [ "${iptables}" = "$IP6V" ] && [ "${dns_hijack_mode}" = "redirect" ] && ip6_nat_supported; then local _dns_port6 _dns_port6="${mihomo_dns_port}"; [ -z "${_dns_port6}" ] && _dns_port6="1053" setup_nat_dns_hijack "NAT_DNS_HIJACK6" "${_dns_port6}" "6" fi if [ "${iptables}" = "$IPV" ]; then ensure_chain nat BOX_EXTERNAL ensure_chain nat BOX_LOCAL fi if [ "${iptables}" = "$IPV" ]; then # DNS 劫持策略（redirect：创建 NAT_DNS_HIJACK；disable：不处理；其他：保留 mihomo 的 UDP DNS 重定向） if [ "${dns_hijack_mode}" = "redirect" ]; then local _dns_port _dns_port="${mihomo_dns_port}" [ -z "${_dns_port}" ] && _dns_port="1053" setup_nat_dns_hijack "NAT_DNS_HIJACK" "${_dns_port}" "4" fi if [ "${dns_hijack_mode}" != "redirect" ] && [ "${dns_hijack_mode}" != "disable" ] && [ "${bin_name}" = "mihomo" ]; then if [ "${dns_hijack_udp}" = "true" ]; then ensure_rule_append nat BOX_EXTERNAL -p udp --dport 53 -j REDIRECT --to-ports "${mihomo_dns_port}" ensure_rule_append nat BOX_LOCAL -p udp --dport 53 -j REDIRECT --to-ports "${mihomo_dns_port}" fi # 其他类型的入站应在此处添加以接收 DNS 流量而不是嗅探 # ${iptables} -t nat -A BOX_EXTERNAL -p udp --dport 53 -j REDIRECT --to-ports "${redir_port}" # ${iptables} -t nat -A BOX_LOCAL -p udp --dport 53 -j REDIRECT --to-ports "${redir_port}" fi # 修复 ICMP（ping），这不能保证 ping 结果有效，仅保证有返回 # if [[ "${bin_name}" == @(mihomo|sing-box) ]]; then # if [ -n "${fake_ip_range}" ]; then # ${iptables} -t nat -A BOX_EXTERNAL -d "${fake_ip_range}" -p icmp -j DNAT --to-destination 127.0.0.1 # ${iptables} -t nat -A BOX_LOCAL -d "${fake_ip_range}" -p icmp -j DNAT --to-destination 127.0.0.1 # fi # fi ensure_chain nat LOCAL_IP_V4 for subnet in ${intranet[@]} ; do ensure_rule_append nat BOX_EXTERNAL -d ${subnet} -j RETURN ensure_rule_append nat BOX_LOCAL -d ${subnet} -j RETURN done # 中国大陆 IP 分流（IPv4 NAT） if [ "${bypass_cn_ip}" = "true" ] && [ "${bypass_cn_ip_v4}" = "true" ] && command -v ipset >/dev/null 2>&1; then ensure_rule_append nat BOX_EXTERNAL -m set --match-set cnip dst -j RETURN ensure_rule_append nat BOX_LOCAL -m set --match-set cnip dst -j RETURN fi ensure_rule_append nat BOX_EXTERNAL -j LOCAL_IP_V4 ensure_rule_append nat BOX_LOCAL -j LOCAL_IP_V4 # 在允许列表之前优先跳过指定接口 if [ "${ignore_ap_list}" != "" ]; then for ignore in "${ignore_ap_list[@]}"; do ensure_rule_append nat BOX_EXTERNAL -i "${ignore}" -j RETURN done [ ${network_mode} = "enhance" ] || log Info "${ignore_ap_list[*]} 入站接口已忽略透明代理。" fi # 对非环回接口的所有TCP流量进行重定向，避免硬编码接口名称 if [ "${proxy_tcp}" = "true" ]; then ensure_rule_append nat BOX_EXTERNAL -p tcp -i lo -j REDIRECT --to-ports "${redir_port}" fi if [ "${ap_list}" != "" ]; then for ap in "${ap_list[@]}"; do if [ "${proxy_tcp}" = "true" ]; then if [ "${mac_filter}" = "true" ]; then if [ "${mac_mode}" = "whitelist" ]; then local _mac_added="false" for mac_item in "${macs_list[@]}"; do local mac mac="$(echo "${mac_item}" | busybox tr '[:upper:]' '[:lower:]' | busybox tr -d '[:space:]')" echo "${mac}" | busybox grep -Eq '^[0-9a-f]{2}(:[0-9a-f]{2}){5}$' || continue ensure_rule_append nat BOX_EXTERNAL -p tcp -i "${ap}" -m mac --mac-source "${mac}" -j REDIRECT --to-ports "${redir_port}" _mac_added="true" done if [ "${_mac_added}" != "true" ]; then [ ${network_mode} = "enhance" ] || log Warning "热点接口 ${ap}：MAC 白名单已启用但列表为空/无有效项，将不代理该接口的客户端流量" fi else for mac_item in "${macs_list[@]}"; do local mac mac="$(echo "${mac_item}" | busybox tr '[:upper:]' '[:lower:]' | busybox tr -d '[:space:]')" echo "${mac}" | busybox grep -Eq '^[0-9a-f]{2}(:[0-9a-f]{2}){5}$' || continue ensure_rule_append nat BOX_EXTERNAL -i "${ap}" -m mac --mac-source "${mac}" -j RETURN done ensure_rule_append nat BOX_EXTERNAL -p tcp -i "${ap}" -j REDIRECT --to-ports "${redir_port}" fi else ensure_rule_append nat BOX_EXTERNAL -p tcp -i "${ap}" -j REDIRECT --to-ports "${redir_port}" fi fi done if [ "${mac_filter}" = "true" ]; then if [ "${mac_mode}" = "whitelist" ]; then [ ${network_mode} = "enhance" ] || log Info "${ap_list[*]} 热点 MAC 白名单透明代理已启用。" else [ ${network_mode} = "enhance" ] || log Info "${ap_list[*]} 热点 MAC 黑名单透明代理已启用。" fi else [ ${network_mode} = "enhance" ] || log Info "${ap_list[*]} 透明代理。" fi fi ensure_jump nat PREROUTING BOX_EXTERNAL ensure_rule_insert nat BOX_LOCAL -m owner --uid-owner "${box_user}" --gid-owner "${box_group}" -j RETURN fi if [ "${iptables}" = "$IPV" ]; then case "${proxy_mode}" in core) ensure_rule_append nat BOX_LOCAL -p tcp -j REDIRECT --to-ports "${redir_port}" [ ${network_mode} = "enhance" ] || log Info "核心模式：所有应用透明代理。" ;; blacklist|black) if [ -z "$(cat "${uid_list}")" ] ; then ensure_rule_append nat BOX_LOCAL -p tcp -j REDIRECT --to-ports "${redir_port}" [ ${network_mode} = "enhance" ] || log Info "所有应用透明代理。" else while read -r appid; do ensure_rule_append nat BOX_LOCAL -m owner --uid-owner "${appid}" -j RETURN done < "${uid_list}" ensure_rule_append nat BOX_LOCAL -p tcp -j REDIRECT --to-ports "${redir_port}" [ ${network_mode} = "enhance" ] || log Info "代理模式: ${proxy_mode} (${packages_list[*]}) 不透明代理。" fi if [ "${gid_list}" != "" ] ; then for gid in ${gid_list[@]} ; do ensure_rule_append nat BOX_LOCAL -m owner --gid-owner ${gid} -j RETURN done [ ${network_mode} = "enhance" ] || { [ "${iptables}" = "$IPV" ] && log Info "代理模式: ${proxy_mode}, GID (${gid_list[*]}) 不透明代理。" } fi ;; whitelist|white) if [ -z "$(cat "${uid_list}")" ] ; then ensure_rule_append nat BOX_LOCAL -p tcp -j REDIRECT --to-ports "${redir_port}" [ ${network_mode} = "enhance" ] || log Info "所有应用透明代理。" else while read -r appid; do ensure_rule_append nat BOX_LOCAL -p tcp -m owner --uid-owner "${appid}" -j REDIRECT --to-ports "${redir_port}" done < "${uid_list}" ensure_rule_append nat BOX_LOCAL -p tcp -m owner --uid-owner 0 -j REDIRECT --to-ports "${redir_port}" ensure_rule_append nat BOX_LOCAL -p tcp -m owner --uid-owner 1052 -j REDIRECT --to-ports "${redir_port}" [ ${network_mode} = "enhance" ] || log Info "代理模式: ${proxy_mode} (${packages_list[*]}) 透明代理。" fi if [ "${gid_list}" != "" ] ; then for gid in ${gid_list[@]} ; do ensure_rule_append nat BOX_LOCAL -p tcp -m owner --gid-owner ${gid} -j REDIRECT --to-ports ${redir_port} done [ ${network_mode} = "enhance" ] || [ "${iptables}" = "$IPV" ] && log Info "代理模式: ${proxy_mode}, GID (${gid_list[*]}) 透明代理。" fi ;; *) log Warning "代理模式: ${proxy_mode} 配置错误。" ensure_rule_append nat BOX_LOCAL -p tcp -j REDIRECT --to-ports "${redir_port}" [ ${network_mode} = "enhance" ] || log Info "所有应用透明代理。" ;; esac fi if [ "${iptables}" = "$IPV" ]; then ensure_jump nat OUTPUT BOX_LOCAL fi if [ "${iptables}" = "$IPV" ]; then ensure_rule_append filter OUTPUT -d 127.0.0.1 -p tcp -m owner --uid-owner "${box_user}" --gid-owner "${box_group}" -m tcp --dport "${redir_port}" -j REJECT else ensure_rule_append filter OUTPUT -d ::1 -p tcp -m owner --uid-owner "${box_user}" --gid-owner "${box_group}" -m tcp --dport "${redir_port}" -j REJECT fi } stop_redirect() { if [ "${iptables}" = "$IPV" ]; then del_jump_silent nat PREROUTING BOX_EXTERNAL del_jump_silent nat OUTPUT BOX_LOCAL del_rule_silent filter OUTPUT -d 127.0.0.1 -p tcp -m owner --uid-owner "${box_user}" --gid-owner "${box_group}" -m tcp --dport "${redir_port}" -j REJECT del_rule_silent filter OUTPUT -d 127.0.0.1 -p tcp -m owner --uid-owner 0:3005 -m tcp --dport "${redir_port}" -j REJECT cleanup_chain_fast nat BOX_EXTERNAL cleanup_chain_fast nat BOX_LOCAL cleanup_chain_fast nat LOCAL_IP_V4 del_jump_silent nat PREROUTING NAT_DNS_HIJACK del_jump_silent nat OUTPUT NAT_DNS_HIJACK cleanup_chain_fast nat NAT_DNS_HIJACK else del_rule_silent filter OUTPUT -d ::1 -p tcp -m owner --uid-owner "${box_user}" --gid-owner "${box_group}" -m tcp --dport "${redir_port}" -j REJECT del_rule_silent filter OUTPUT -d ::1 -p tcp -m owner --uid-owner 0:3005 -m tcp --dport "${redir_port}" -j REJECT fi if [ "${iptables}" = "$IP6V" ]; then del_jump_silent nat PREROUTING NAT_DNS_HIJACK6 del_jump_silent nat OUTPUT NAT_DNS_HIJACK6 cleanup_chain_fast nat NAT_DNS_HIJACK6 fi } start_tproxy() { if [ "${iptables}" = "$IP6V" ] && [ "${cap_tproxy6}" != "true" ]; then [ "${ipv6}" = "true" ] && log Warning "未检测到 IPv6 TPROXY 支持，跳过 ip6tables TProxy 规则" return 1 fi if [ "${iptables}" = "$IPV" ]; then ensure_ip_rule ip "${fwmark}" "${table}" "${pref}" ensure_ip_route_local_default ip "${table}" else ensure_ip_rule "ip -6" "${fwmark}" "${table}" "${pref}" ensure_ip_route_local_default "ip -6" "${table}" fi ensure_chain mangle BOX_EXTERNAL # ${iptables} -t mangle -A BOX_EXTERNAL -m mark --mark ${routing_mark} -j RETURN # 跳过部分接口，注意：有些接口名为 r_ / oem / nm_ / qcom_，可能需要更复杂的处理 # ${iptables} -t mangle -I BOX_EXTERNAL -i rmnet_data+ -j RETURN # ${iptables} -t mangle -I BOX_EXTERNAL -i ccmni+ -j RETURN if [ "${dns_hijack_mode}" = "redirect" ]; then if [ ${network_mode} != "enhance" ] && [ "${dns_hijack_tcp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p tcp --dport 53 -j RETURN fi if [ "${dns_hijack_udp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p udp --dport 53 -j RETURN fi elif [ "${dns_hijack_mode}" = "disable" ]; then if [ ${network_mode} != "enhance" ] && [ "${dns_hijack_tcp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p tcp --dport 53 -j RETURN fi if [ "${dns_hijack_udp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p udp --dport 53 -j RETURN fi else if [ "${mihomo_dns_forward}" = "enable" ] && [[ "${bin_name}" == @(mihomo|hysteria) ]] ; then if [ ${network_mode} != "enhance" ] && [ "${dns_hijack_tcp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p tcp --dport 53 -j RETURN fi if [ "${dns_hijack_udp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p udp --dport 53 -j RETURN fi else if [ ${network_mode} != "enhance" ] && [ "${dns_hijack_tcp}" = "true" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p tcp --dport 53 -j TPROXY --on-port ${tproxy_port} --tproxy-mark ${fwmark} fi if [ "${dns_hijack_udp}" = "true" ] && [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p udp --dport 53 -j TPROXY --on-port ${tproxy_port} --tproxy-mark ${fwmark} fi fi fi # NAT DNS 劫持链在后续（本地防回环规则之后）统一创建，避免重复插入 # 跳过已被 TProxy 处理的流量，若默认路由接口有公网 IP，省略这些规则会导致本地流量代理异常，可能拖慢全网 # if [ "${cap_socket_match}" = "true" ]; then # if [ ${network_mode} != "enhance" ] && [ "${proxy_tcp}" = "true" ]; then # ensure_rule_append mangle BOX_EXTERNAL -p tcp -m socket --transparent -j MARK --set-xmark ${fwmark} # fi # if [ "${proxy_udp}" = "true" ]; then # ensure_rule_append mangle BOX_EXTERNAL -p udp -m socket --transparent -j MARK --set-xmark ${fwmark} # fi # if [ "${proxy_tcp}" = "true" ] || [ "${proxy_udp}" = "true" ]; then # ensure_rule_append mangle BOX_EXTERNAL -m socket -j RETURN # fi # else # [ "${iptables}" = "$IPV" ] && log Warning "未检测到 socket match，跳过部分优化规则（不影响基本功能）" # fi # 跳过内网，兼容性可用 su -c 'zcat /proc/config.gz | grep -i addrtype' 检查 # ${iptables} -t mangle -A BOX_EXTERNAL -m addrtype --dst-type LOCAL -j RETURN if [ "${iptables}" = "$IPV" ]; then for subnet in ${intranet[@]} ; do ensure_rule_append mangle BOX_EXTERNAL -d ${subnet} -j RETURN done ensure_chain mangle LOCAL_IP_V4 [ "${bypass_cn_ip}" = "true" ] && [ "${bypass_cn_ip_v4}" = "true" ] && command -v ipset >/dev/null 2>&1 && ensure_rule_append mangle BOX_EXTERNAL -m set --match-set cnip dst -j RETURN ensure_rule_append mangle BOX_EXTERNAL -j LOCAL_IP_V4 else # 优先处理 IPv6 fake-ip，避免被 intranet6 (包含 fc00::/7) 提前放行 if [ -n "${fake_ip6_range}" ] && [ "${bin_name}" = "mihomo" ]; then if [ ${network_mode} != "enhance" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p tcp -d "${fake_ip6_range}" -j TPROXY --on-port "${tproxy_port}" --tproxy-mark "${fwmark}" fi if [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p udp -d "${fake_ip6_range}" -j TPROXY --on-port "${tproxy_port}" --tproxy-mark "${fwmark}" fi fi for subnet6 in ${intranet6[@]} ; do ensure_rule_append mangle BOX_EXTERNAL -d ${subnet6} -j RETURN done ensure_chain mangle LOCAL_IP_V6 [ "${bypass_cn_ip}" = "true" ] && [ "${bypass_cn_ip_v6}" = "true" ] && command -v ipset >/dev/null 2>&1 && ensure_rule_append mangle BOX_EXTERNAL -m set --match-set cnip6 dst -j RETURN ensure_rule_append mangle BOX_EXTERNAL -j LOCAL_IP_V6 fi # 在任何 TPROXY 规则之前优先生效，防止被后续 allow 接口（如 wlan+）覆盖 if [ "${ignore_ap_list}" != "" ]; then for ignore in ${ignore_ap_list[@]} ; do ensure_rule_append mangle BOX_EXTERNAL -i "${ignore}" -j RETURN done [ "${iptables}" = "$IPV" ] && log Info "${ignore_ap_list[*]} 入站接口已忽略透明代理。" fi if [ ${network_mode} != "enhance" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p tcp -i lo -j TPROXY --on-port "${tproxy_port}" --tproxy-mark "${fwmark}" fi if [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p udp -i lo -j TPROXY --on-port "${tproxy_port}" --tproxy-mark "${fwmark}" fi # 允许 ap 接口，注意：老设备只有一个 wlan，新设备可能有多个（如 wlan0 上网，wlan1 AP），遍历 ap 列表 if [ "${ap_list}" != "" ]; then for ap in ${ap_list[@]} ; do if [ "${mac_filter}" = "true" ]; then if [ "${mac_mode}" = "whitelist" ]; then local _mac_added="false" for mac_item in "${macs_list[@]}"; do local mac mac="$(echo "${mac_item}" | busybox tr '[:upper:]' '[:lower:]' | busybox tr -d '[:space:]')" echo "${mac}" | busybox grep -Eq '^[0-9a-f]{2}(:[0-9a-f]{2}){5}$' || continue if [ ${network_mode} != "enhance" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p tcp -i "${ap}" -m mac --mac-source "${mac}" -j TPROXY --on-port "${tproxy_port}" --tproxy-mark "${fwmark}" fi if [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p udp -i "${ap}" -m mac --mac-source "${mac}" -j TPROXY --on-port "${tproxy_port}" --tproxy-mark "${fwmark}" fi _mac_added="true" done if [ "${_mac_added}" != "true" ]; then [ "${iptables}" = "$IPV" ] && [ ${network_mode} != "enhance" ] && log Warning "热点接口 ${ap}：MAC 白名单已启用但列表为空/无有效项，将不代理该接口的客户端流量" fi else for mac_item in "${macs_list[@]}"; do local mac mac="$(echo "${mac_item}" | busybox tr '[:upper:]' '[:lower:]' | busybox tr -d '[:space:]')" echo "${mac}" | busybox grep -Eq '^[0-9a-f]{2}(:[0-9a-f]{2}){5}$' || continue if [ ${network_mode} != "enhance" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p tcp -i "${ap}" -m mac --mac-source "${mac}" -j RETURN fi if [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p udp -i "${ap}" -m mac --mac-source "${mac}" -j RETURN fi done if [ ${network_mode} != "enhance" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p tcp -i "${ap}" -j TPROXY --on-port "${tproxy_port}" --tproxy-mark "${fwmark}" fi if [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p udp -i "${ap}" -j TPROXY --on-port "${tproxy_port}" --tproxy-mark "${fwmark}" fi fi else if [ ${network_mode} != "enhance" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p tcp -i "${ap}" -j TPROXY --on-port "${tproxy_port}" --tproxy-mark "${fwmark}" fi if [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_EXTERNAL -p udp -i "${ap}" -j TPROXY --on-port "${tproxy_port}" --tproxy-mark "${fwmark}" fi fi done if [ "${iptables}" = "$IPV" ]; then if [ "${mac_filter}" = "true" ]; then if [ "${mac_mode}" = "whitelist" ]; then [ ${network_mode} = "enhance" ] || log Info "${ap_list[*]} 热点 MAC 白名单透明代理已启用。" else [ ${network_mode} = "enhance" ] || log Info "${ap_list[*]} 热点 MAC 黑名单透明代理已启用。" fi else [ ${network_mode} = "enhance" ] || log Info "${ap_list[*]} 透明代理。" fi fi fi ensure_jump mangle PREROUTING BOX_EXTERNAL ensure_chain mangle BOX_LOCAL ensure_rule_insert mangle BOX_LOCAL -m owner --uid-owner ${box_user} --gid-owner ${box_group} -j RETURN # ${iptables} -t mangle -A BOX_LOCAL -m mark --mark ${routing_mark} -j RETURN if [ "${dns_hijack_mode}" = "redirect" ] || [ "${dns_hijack_mode}" = "disable" ]; then if [ ${network_mode} != "enhance" ] && [ "${dns_hijack_tcp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p tcp --dport 53 -j RETURN fi if [ "${dns_hijack_udp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p udp --dport 53 -j RETURN fi else if [ "${mihomo_dns_forward}" = "enable" ] && [[ "${bin_name}" == @(mihomo|hysteria) ]] ; then if [ ${network_mode} != "enhance" ] && [ "${dns_hijack_tcp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p tcp --dport 53 -j RETURN fi if [ "${dns_hijack_udp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p udp --dport 53 -j RETURN fi else if [ ${network_mode} != "enhance" ] && [ "${dns_hijack_tcp}" = "true" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p tcp --dport 53 -j MARK --set-xmark ${fwmark} fi if [ "${dns_hijack_udp}" = "true" ] && [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p udp --dport 53 -j MARK --set-xmark ${fwmark} fi fi fi if [ "${iptables}" = "$IPV" ]; then for subnet in ${intranet[@]} ; do ensure_rule_append mangle BOX_LOCAL -d ${subnet} -j RETURN done [ "${bypass_cn_ip}" = "true" ] && [ "${bypass_cn_ip_v4}" = "true" ] && command -v ipset >/dev/null 2>&1 && ensure_rule_append mangle BOX_LOCAL -m set --match-set cnip dst -j RETURN ensure_rule_append mangle BOX_LOCAL -j LOCAL_IP_V4 else # 为本地发起的 IPv6 fake-ip 目的流量优先打标，避免被 intranet6 提前放行 if [ -n "${fake_ip6_range}" ] && [ "${bin_name}" = "mihomo" ]; then if [ ${network_mode} != "enhance" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p tcp -d "${fake_ip6_range}" -j MARK --set-xmark "${fwmark}" fi if [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p udp -d "${fake_ip6_range}" -j MARK --set-xmark "${fwmark}" fi fi for subnet6 in ${intranet6[@]} ; do ensure_rule_append mangle BOX_LOCAL -d ${subnet6} -j RETURN done [ "${bypass_cn_ip}" = "true" ] && [ "${bypass_cn_ip_v6}" = "true" ] && command -v ipset >/dev/null 2>&1 && ensure_rule_append mangle BOX_LOCAL -m set --match-set cnip6 dst -j RETURN ensure_rule_append mangle BOX_LOCAL -j LOCAL_IP_V6 fi case "${proxy_mode}" in core) if [ ${network_mode} != "enhance" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p tcp -j MARK --set-xmark "${fwmark}" fi if [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p udp -j MARK --set-xmark "${fwmark}" fi [ "${iptables}" = "$IPV" ] && log Info "核心模式：所有应用透明代理。" ;; blacklist|black) if [ -z "$(cat "${uid_list}")" ] ; then if [ ${network_mode} != "enhance" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p tcp -j MARK --set-xmark "${fwmark}" fi if [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p udp -j MARK --set-xmark "${fwmark}" fi [ "${iptables}" = "$IPV" ] && log Info "所有应用透明代理。" else while read -r appid; do ensure_rule_append mangle BOX_LOCAL -m owner --uid-owner "${appid}" -j RETURN done < "${uid_list}" if [ ${network_mode} != "enhance" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p tcp -j MARK --set-xmark "${fwmark}" fi if [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p udp -j MARK --set-xmark "${fwmark}" fi [ "${iptables}" = "$IPV" ] && log Info "代理模式: ${proxy_mode} (${packages_list[*]}) 不透明代理。" fi if [ "${gid_list}" != "" ] ; then for gid in ${gid_list[@]} ; do ensure_rule_append mangle BOX_LOCAL -m owner --gid-owner ${gid} -j RETURN done [ "${iptables}" = "$IPV" ] && log Info "代理模式: ${proxy_mode}, GID (${gid_list[*]}) 不透明代理。" fi ;; whitelist|white) if [ -z "$(cat "${uid_list}")" ] ; then if [ ${network_mode} != "enhance" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p tcp -j MARK --set-xmark "${fwmark}" fi if [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p udp -j MARK --set-xmark "${fwmark}" fi [ "${iptables}" = "$IPV" ] && log Info "所有应用透明代理。" else while read -r appid; do if [ ${network_mode} != "enhance" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p tcp -m owner --uid-owner "${appid}" -j MARK --set-xmark "${fwmark}" fi if [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p udp -m owner --uid-owner "${appid}" -j MARK --set-xmark "${fwmark}" fi done < "${uid_list}" if [ ${network_mode} != "enhance" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p tcp -m owner --uid-owner 0 -j MARK --set-xmark "${fwmark}" fi if [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p udp -m owner --uid-owner 0 -j MARK --set-xmark "${fwmark}" fi if [ ${network_mode} != "enhance" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p tcp -m owner --uid-owner 1052 -j MARK --set-xmark "${fwmark}" fi if [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p udp -m owner --uid-owner 1052 -j MARK --set-xmark "${fwmark}" fi [ "${iptables}" = "$IPV" ] && log Info "代理模式: ${proxy_mode} (${packages_list[*]}) 透明代理。" fi if [ "${gid_list}" != "" ] ; then for gid in ${gid_list[@]} ; do if [ ${network_mode} != "enhance" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p tcp -m owner --gid-owner ${gid} -j MARK --set-xmark "${fwmark}" fi if [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p udp -m owner --gid-owner ${gid} -j MARK --set-xmark "${fwmark}" fi done [ "${iptables}" = "$IPV" ] && log Info "代理模式: ${proxy_mode}, GID (${gid_list[*]}) 透明代理。" fi ;; *) log Debug "代理模式: ${proxy_mode} 配置错误" if [ ${network_mode} != "enhance" ] && [ "${proxy_tcp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p tcp -j MARK --set-xmark "${fwmark}" fi if [ "${proxy_udp}" = "true" ]; then ensure_rule_append mangle BOX_LOCAL -p udp -j MARK --set-xmark "${fwmark}" fi [ "${iptables}" = "$IPV" ] && log Info "所有应用透明代理。" ;; esac ensure_jump mangle OUTPUT BOX_LOCAL ensure_chain mangle DIVERT ensure_rule_append mangle DIVERT -j MARK --set-xmark "${fwmark}" ensure_rule_append mangle DIVERT -j ACCEPT if [ ${network_mode} != "enhance" ]; then if [ "${cap_socket_match}" = "true" ]; then ensure_rule_insert mangle PREROUTING -p tcp -m socket -j DIVERT fi fi # 禁用 QUIC if [ "${quic}" = "disable" ] && [ "${proxy_udp}" = "true" ]; then ensure_rule_append filter OUTPUT -p udp --dport 443 -j REJECT ensure_rule_append filter OUTPUT -p udp --dport 80 -j REJECT # ${iptables} -A OUTPUT -p udp -m multiport --dport 443,80 -j REJECT [ "${iptables}" = "$IPV" ] && log Warning "已禁用 QUIC" fi if [ ${network_mode} != "enhance" ]; then # 阻止本地访问 tproxy 端口，防止流量回环 if [ "${iptables}" = "$IPV" ]; then ensure_rule_append filter OUTPUT -d 127.0.0.1 -p tcp -m owner --uid-owner "${box_user}" --gid-owner "${box_group}" -m tcp --dport "${tproxy_port}" -j REJECT else ensure_rule_append filter OUTPUT -d ::1 -p tcp -m owner --uid-owner "${box_user}" --gid-owner "${box_group}" -m tcp --dport "${tproxy_port}" -j REJECT fi fi if [ "${iptables}" = "$IPV" ]; then if [ "${dns_hijack_mode}" = "redirect" ]; then local _dns_port _dns_port="${mihomo_dns_port}" [ -z "${_dns_port}" ] && _dns_port="1053" setup_nat_dns_hijack "NAT_DNS_HIJACK" "${_dns_port}" "4" elif [ "${mihomo_dns_forward}" = "enable" ] && [ "${bin_name}" = "mihomo" ]; then ensure_chain nat MIHOMO_DNS_EXTERNAL ensure_rule_append nat MIHOMO_DNS_EXTERNAL -p udp --dport 53 -j REDIRECT --to-ports "${mihomo_dns_port}" ensure_jump nat PREROUTING MIHOMO_DNS_EXTERNAL ensure_chain nat MIHOMO_DNS_LOCAL ensure_rule_insert nat MIHOMO_DNS_LOCAL -m owner --uid-owner "${box_user}" --gid-owner "${box_group}" -j RETURN ensure_rule_append nat MIHOMO_DNS_LOCAL -p udp --dport 53 -j REDIRECT --to-ports "${mihomo_dns_port}" ensure_jump nat OUTPUT MIHOMO_DNS_LOCAL fi # 修复 ICMP（ping），这不能保证 ping 结果有效（如 clash 不支持转发 ICMP），仅保证有返回，--to-destination 可设为可达地址 if [[ "${bin_name}" == @(mihomo|sing-box) ]]; then if [ -n "${fake_ip_range}" ]; then ensure_rule_insert nat OUTPUT -d "${fake_ip_range}" -p icmp -j DNAT --to-destination 127.0.0.1 ensure_rule_insert nat PREROUTING -d "${fake_ip_range}" -p icmp -j DNAT --to-destination 127.0.0.1 fi fi fi } stop_tproxy() { if [ "${iptables}" = "$IPV" ]; then del_ip_rule_if_exists ip "${fwmark}" "${table}" "${pref}" del_ip_route_local_default_if_exists ip "${table}" ip route flush table "${table}" >/dev/null 2>&1 || true ip rule del pref "${pref}" >/dev/null 2>&1 || true else del_ip_rule_if_exists "ip -6" "${fwmark}" "${table}" "${pref}" del_ip_route_local_default_if_exists "ip -6" "${table}" ip -6 route flush table "${table}" >/dev/null 2>&1 || true ip -6 rule del pref "${pref}" >/dev/null 2>&1 || true fi del_jump_silent mangle PREROUTING BOX_EXTERNAL del_jump_silent mangle OUTPUT BOX_LOCAL del_rule_silent mangle PREROUTING -p tcp -m socket -j DIVERT cleanup_chain_fast mangle BOX_EXTERNAL cleanup_chain_fast mangle BOX_LOCAL if [ "${iptables}" = "$IPV" ]; then cleanup_chain_fast mangle LOCAL_IP_V4 else cleanup_chain_fast mangle LOCAL_IP_V6 fi cleanup_chain_fast mangle DIVERT # 清理 QUIC del_rule_silent filter OUTPUT -p udp -m multiport --dport 443,80 -j REJECT del_rule_silent filter OUTPUT -p udp --dport 443 -j REJECT del_rule_silent filter OUTPUT -p udp --dport 80 -j REJECT if [ "${iptables}" = "$IPV" ]; then del_rule_silent filter OUTPUT -d 127.0.0.1 -p tcp -m owner --uid-owner "${box_user}" --gid-owner "${box_group}" -m tcp --dport "${tproxy_port}" -j REJECT del_rule_silent filter OUTPUT -d 127.0.0.1 -p tcp -m owner --uid-owner 0 --gid-owner 3005 -m tcp --dport "${tproxy_port}" -j REJECT else del_rule_silent filter OUTPUT -d ::1 -p tcp -m owner --uid-owner "${box_user}" --gid-owner "${box_group}" -m tcp --dport "${tproxy_port}" -j REJECT del_rule_silent filter OUTPUT -d ::1 -p tcp -m owner --uid-owner 0 --gid-owner 3005 -m tcp --dport "${tproxy_port}" -j REJECT fi if [ "${iptables}" = "$IPV" ]; then del_jump_silent nat PREROUTING MIHOMO_DNS_EXTERNAL del_jump_silent nat OUTPUT MIHOMO_DNS_LOCAL cleanup_chain_fast nat MIHOMO_DNS_EXTERNAL cleanup_chain_fast nat MIHOMO_DNS_LOCAL # 清理自定义 NAT DNS 劫持链（当 dns_hijack_mode=redirect 时创建） del_jump_silent nat PREROUTING NAT_DNS_HIJACK del_jump_silent nat OUTPUT NAT_DNS_HIJACK cleanup_chain_fast nat NAT_DNS_HIJACK if [ -n "${fake_ip_range}" ]; then del_rule_silent nat OUTPUT -p icmp -d "${fake_ip_range}" -j DNAT --to-destination 127.0.0.1 del_rule_silent nat PREROUTING -p icmp -d "${fake_ip_range}" -j DNAT --to-destination 127.0.0.1 del_rule_silent nat OUTPUT -d "${fake_ip_range}" -p icmp -j DNAT --to-destination 127.0.0.1 del_rule_silent nat PREROUTING -d "${fake_ip_range}" -p icmp -j DNAT --to-destination 127.0.0.1 fi fi if [ "${iptables}" = "$IP6V" ]; then # 清理 IPv6 NAT DNS 劫持链（如存在） del_jump_silent nat PREROUTING NAT_DNS_HIJACK6 del_jump_silent nat OUTPUT NAT_DNS_HIJACK6 cleanup_chain_fast nat NAT_DNS_HIJACK6 fi } cleanup_iptables() { for iptables in "$IPV" "$IP6V"; do iptables="${iptables}" && { stop_redirect stop_tproxy forward -D } > /dev/null 2>&1 if [ "${iptables}" = "$IP6V" ]; then del_rule_if_exists filter OUTPUT -p udp --destination-port 53 -j DROP fi done } log_iptables_results() { [ "${network_mode}" = "tun" ] && return 0 log Info "操作: 添加 iptables 规则" log_context log Info "代理模式: ${proxy_mode}" local applied_uids=$(cat "${uid_list}" 2>/dev/null | tr '\n' ' ') if [ -n "$applied_uids" ]; then log Debug "应用的 UIDs: $applied_uids" else if [[ "$proxy_mode" == "core" ]]; then log Debug "(核心模式, 所有应用透明代理)" elif [[ "$proxy_mode" == "whitelist" || "$proxy_mode" == "white" ]]; then log Debug "(列表为空, 代理所有应用)" else log Debug "(列表为空, 不代理任何应用)" fi fi } log_iptables_cleanup() { log Info "操作: 清理 iptables 规则" log_context } if [ "$1" = "disable" ]; then runtime_load >/dev/null 2>&1 || true fi if [[ "${network_mode}" == @(redirect|mixed|tproxy|enhance) ]]; then case "$1" in enable|renew) apply_capability_downgrades box_etc log Info "$IPV + $IP6V" probe_user_group || { log Error "检测 BOX 用户组失败，请确保 ${bin_name} 内核已启动。" } log_iptables_results cleanup_iptables # 准备大陆 IP 分流 ipset if [ "${bypass_cn_ip}" = "true" ]; then setup_cn_ipset || log Warning "CN IP 分流初始化失败，已跳过" fi [ $1 = "renew" ] && log Warning "正在清理 iptables 透明代理规则。" case "${network_mode}" in tproxy) log Info "使用 Tproxy: tcp + udp。" log Info "正在创建 iptables 透明代理规则。" iptables="$IPV" if start_tproxy; then log Info "iptables 透明代理规则创建完成。" else log Error "iptables 透明代理规则创建失败。" stop_tproxy > /dev/null 2>&1 fi if [ "${ipv6}" = "true" ]; then log Debug "启用 IPv6。" ipv6_enable iptables="$IP6V" if start_tproxy; then log Info "ip6tables 透明代理规则创建完成。" else log Error "ip6tables 透明代理规则创建失败。" stop_tproxy > /dev/null 2>&1 fi else disable_ipv6 log Warning "已禁用 IPv6。" fi ;; redirect) log Info "使用 Redirect: tcp + udp（直连）。" log Info "正在创建 iptables 透明代理规则。" iptables="$IPV" if start_redirect; then log Info "iptables 透明代理规则创建完成。" else log Error "iptables 透明代理规则创建失败。" stop_redirect > /dev/null 2>&1 fi if [ "${ipv6}" = "true" ]; then log Debug "启用 IPv6。" ipv6_enable iptables="$IP6V" if start_redirect; then log Info "ip6tables 透明代理规则创建完成。" else log Error "ip6tables 透明代理规则创建失败。" stop_redirect > /dev/null 2>&1 fi else disable_ipv6 log Warning "已禁用 IPv6。" fi ;; mixed) log Info "使用 Mixed: tcp(redirect) + udp(tun)。" log Info "正在创建 iptables 透明代理规则。" iptables="$IPV" probe_tun_device || log Error "未找到 TUN 设备: (${tun_device})" forward -I || forward -D > /dev/null 2>&1 if start_redirect; then log Info "iptables 透明代理规则创建完成。" else log Error "iptables 透明代理规则创建失败。" stop_redirect > /dev/null 2>&1 fi if [ "${ipv6}" = "true" ]; then log Debug "启用 IPv6。" ipv6_enable iptables="$IP6V" forward -I || forward -D > /dev/null 2>&1 if start_redirect; then log Info "ip6tables 透明代理规则创建完成。" else log Error "ip6tables 透明代理规则创建失败。" stop_redirect > /dev/null 2>&1 fi else disable_ipv6 log Warning "已禁用 IPv6。" fi ;; enhance) log Info "使用 Enhance: tcp(redirect) + udp(tproxy)" log Info "正在创建 iptables 透明代理规则。" iptables="$IPV" if start_redirect && start_tproxy; then log Info "iptables 透明代理规则创建完成。" else log Error "iptables 透明代理规则创建失败。" stop_redirect > /dev/null 2>&1 fi if [ "${ipv6}" = "true" ]; then log Debug "启用 IPv6。" ipv6_enable iptables="$IP6V" if start_redirect && start_tproxy; then log Info "ip6tables 透明代理规则创建完成。" else log Error "ip6tables 透明代理规则创建失败。" stop_redirect > /dev/null 2>&1 fi else disable_ipv6 log Warning "已禁用 IPv6。" fi ;; *) log Error "network_mode: ${network_mode}，未知模式" exit 1 ;; esac runtime_save [ $1 = "renew" ] && log Debug "重启 iptables 透明代理规则完成。" bin_alive && log Info "${bin_name} 已连接。" ;; disable) runtime_load >/dev/null 2>&1 || true ipv6_enable probe_user_group || log Error "检测 BOX 用户组失败，请确保 ${bin_name} 内核已启动。" log_iptables_cleanup log Warning "正在清理 iptables 透明代理规则。" cleanup_iptables # 清理大陆 IP 分流 ipset if [ "${bypass_cn_ip}" = "true" ]; then cleanup_cn_ipset fi runtime_clear log Warning "iptables 透明代理规则清理完成。" ;; *) echo "${red}$0 $1 未知命令${normal}" echo "${yellow}用法:${normal} ${green}$0${normal} {${yellow}enable|disable|renew${normal}}" ;; esac else case "$1" in enable|renew) apply_capability_downgrades box_etc log Info "$IPV + $IP6V" log Info "使用 Tun: tcp + udp。" probe_user_group || { log Error "检测 BOX 用户组失败，请确保 ${bin_name} 内核已启动。" } log_iptables_results cleanup_iptables probe_tun_device || log Error "未找到 TUN 设备: (${tun_device})" [ $1 = "renew" ] && log Warning "正在清理 TUN 规则。" iptables="$IPV" [ -n "${packages_list}" ] && log Debug "代理模式: $proxy_mode (${packages_list[*]})" if forward -I; then log Info "iptables TUN 规则创建完成。" else log Error "iptables TUN 规则创建失败。" forward -D > /dev/null 2>&1 fi if [ "${ipv6}" = "true" ]; then log Debug "启用 IPv6。" ipv6_enable iptables="$IP6V" if forward -I; then log Info "ip6tables TUN 规则创建完成。" else log Error "ip6tables TUN 规则创建失败。" forward -D > /dev/null 2>&1 fi else disable_ipv6 log Warning "已禁用 IPv6。" fi runtime_save [ $1 = "renew" ] && log Info "重启 iptables TUN 规则完成。" bin_alive && log Info "${bin_name} 已连接。" ;; disable) runtime_load >/dev/null 2>&1 || true ipv6_enable probe_user_group || log Error "检测 BOX 用户组失败，请确保 ${bin_name} 内核已启动。" log_iptables_cleanup log Warning "正在清理 TUN 规则。" cleanup_iptables runtime_clear log Warning "TUN 规则清理完成。" ;; *) echo "${red}$0: '$1' 未知命令${normal}" echo "${yellow}用法:${normal} ${green}$0${normal} {${yellow}enable|disable|renew${normal}}" ;; esac fibox-debug/box/scripts/box.service000077500000000000000000001014041516412072700173730ustar00rootroot00000000000000#!/system/bin/sh scripts_dir="${0%/*}" source /data/adb/box/settings.ini PROPFILE="/data/adb/modules/box_for_root/module.prop" find_packages_uid() { log Info "代理模式: ${proxy_mode}" if [ "${proxy_mode}" = "core" ]; then log Info "核心模式已启用，跳过 package 和 gid 处理" > "${uid_list}" return 0 fi log Info "开始处理 UID/GID 列表" log Debug "应用列表 (来自 package.list.cfg): ${packages_list[*]}" log Debug "GID 列表 (来自 gid.list.cfg): ${gid_list[*]}" > "${uid_list}" local packages_file packages_file="${system_packages_file:-/data/system/packages.list}" for entry in "${packages_list[@]}"; do local prefix="0" local package="${entry}" case "${entry}" in *:*) prefix="${entry%%:*}" package="${entry#*:}" ;; esac case "${prefix}" in ''|*[!0-9]*) log Warning "Failure: 用户 \"${prefix}\" 应用: \"${package}\" -> 用户前缀无效，已回退为 0" prefix="0" ;; esac if [ -z "${package}" ] || [ "${package}" = "${entry}" ] && [ "${entry}" = "${prefix}" ]; then log Warning "Failure: 用户 \"${prefix}\" 应用: \"${entry}\" -> 包名无效" continue fi local base_uid base_uid=$(busybox awk -v pkg="${package}" '$1 == pkg {print $2; exit}' "${packages_file}" 2>/dev/null) case "${base_uid}" in ''|*[!0-9]*) log Warning "Failure: 用户 \"${prefix}\" 应用: \"${package}\" -> 未找到" continue ;; esac local multiuser_uid=$((base_uid + prefix * 100000)) echo "${multiuser_uid}" >> "${uid_list}" log Info "Success: 用户 \"${prefix}\" 应用: \"${package}\" -> ${multiuser_uid}" done if [ ${#gid_list[@]} -gt 0 ]; then printf "%s\n" "${gid_list[@]}" >> "${uid_list}" log Info "Success: GID: ${gid_list[*]} -> 已添加" fi if [ -s "${uid_list}" ]; then local temp_uid_list="${box_run_state}/temp_uid.list" busybox sort -un "${uid_list}" > "${temp_uid_list}" mv "${temp_uid_list}" "${uid_list}" fi } log_service_results() { local core_name="$1" local proxy_mode_type="$2" local uids="$3" log Info "操作: 更新TUN模式UID列表" log Info "模式: ${proxy_mode_type}" if [ "${proxy_mode_type}" = "core" ]; then log Debug "(核心模式, 所有应用透明代理)" elif [ -n "$uids" ]; then log Debug "应用的 UIDs: ${uids}" else log Debug "(无)" fi } box_check_logs() { # 删除所有内核日志并备份 log Info "删除并备份日志文件" ( for bin in "${bin_list[@]}"; do if [ -f "${box_run}/${bin}.log" ]; then mv "${box_run}/${bin}.log" "${box_run}/${bin}.old.log" fi done # 删除其他日志文件 find "${box_run}" -maxdepth 1 -type f \( -name "root" -o -name "*.inotify.log" \) -exec rm -f {} + find "${box_run_state}" -maxdepth 1 -type f \( -name "*.list" -a ! -name "appuid.list" \) -exec rm -f {} + # 删除一天前的日志 find "${box_run}" -maxdepth 1 -type f \( -name "*.log" -o -name "*.old.log" \) -mtime +1 -exec rm -f {} + ) & } box_bin_alive() { local PID=$(<"${box_pid}" 2>/dev/null) if ! kill -0 "$PID" >/dev/null 2>&1; then log Error "$(<"${box_run}/${bin_name}.log")" log Error "${bin_name} 服务未运行。" log Error "请检查 ${bin_name}.log 获取详细信息。" log Error "清理无效 pid $PID" for bin in "${bin_list[@]}"; do killall -15 "${bin}" >/dev/null || busybox pkill -15 "${bin}" >/dev/null 2>&1 done "${scripts_dir}/box.iptables" disable >/dev/null 2>&1 [ -f "${box_pid}" ] && rm -f "${box_pid}" exit 1 else return 0 fi } box_run_crontab() { pkill -f "busybox crond" >/dev/null 2>&1 busybox crontab -c "${box_run_state}" -r echo "# root 的定时任务" > "${box_run_state}/root" if [ "${run_crontab}" = "true" ]; then log Debug "crond 已启用" if [ "$update_subscription" = "true" ] || [ "$update_geo" = "true" ]; then log Debug "定时任务间隔: ${interva_update}." echo "${interva_update} ${scripts_dir}/box.tool geosub" >> "${box_run_state}/root" log Info "${bin_name} geox 更新: ${update_geo}." if [ "${bin_name}" = "mihomo" ]; then log Info "${bin_name} 订阅更新: ${update_subscription}." fi fi cat "${box_dir}/crontab.cfg" >> "${box_run_state}/root" chmod 0644 "${box_run_state}/root" nohup busybox crond -c "${box_run_state}" >/dev/null 2>&1 & else log Info "crond 已禁用" fi } box_ownership() { # 设置内核目录权限和属主 chown -R "${box_user_group}" "${box_dir}" chmod -R 644 "${box_dir}/${bin_name}" chown "${box_user_group}" "${bin_path}" chmod 6755 "${bin_path}" chmod 0700 "${box_dir}/bin/yq" chmod 0700 "${box_dir}/bin/curl" } box_permission() { if [[ "${box_user_group}" == @(root:net_admin|0:3005) && -f "${bin_path}" ]]; then # 设置内核目录权限和属主 box_ownership log Info "使用内核 ${bin_path}。" else if [[ "${box_user_group}" != @(root:net_admin|0:3005) ]]; then log Error "不支持的用户组 [ \"${box_user_group}\" ]" sed -i "s/box_user_group=.*/box_user_group=\"root:net_admin\"/g" "${settings}" log Debug "已自动切换为 [ root:net_admin ]，请重启 box" exit 1 fi log Error "未检测到内核 [ \"${bin_name}\" ]。" log Error "请下载 [ \"${bin_name}\" ] 内核并放置到 \"${bin_dir}/\" 目录下。" log Debug "可在终端执行 'su -c \"${scripts_dir}/box.tool upkernel\"' 下载内核" set_description error "内核不存在" exit 1 fi } box_check_bin() { if [ ! -x "${bin_path}" ]; then log Error "${bin_path} 不可执行。" set_description error "内核不可执行" exit 1 fi local version_output case "${bin_name}" in mihomo) version_output=$("${bin_path}" -v 2>/dev/null) || { log Error "${bin_name} 版本信息获取失败。" set_description error "内核损坏" exit 1 } ;; *) version_output=$("${bin_path}" version 2>/dev/null) || { log Error "${bin_name} 版本信息获取失败。" set_description error "内核损坏" exit 1 } ;; esac log Info "${version_output}" } prepare_singbox() { # 检查配置文件 if ! [ -f "${sing_config}" ]; then log Error "未找到配置文件 ${sing_config}" set_description error "配置文件不存在" exit 1 else log Info "检测到配置 ${sing_config}" fi # 检查 yq yq="yq" if ! command -v yq >/dev/null 2>&1; then if [ ! -x "${box_dir}/bin/yq" ]; then log Debug "未找到 yq，开始从 GitHub 下载" "${scripts_dir}/box.tool" upyq fi yq="${box_dir}/bin/yq" fi # 设置 auto_detect_interface/auto_route ${yq} '.route.auto_detect_interface = true' -i --output-format=json "${sing_config}" ${yq} '(.inbounds[] | select(.type == "tun") | .auto_route) |= true' -i --output-format=json "${sing_config}" # 确保日志路径是绝对路径 ${yq} '.log.output = "'"${box_run}/${bin_name}.log"'"' -i --output-format=json "${sing_config}" 2>/dev/null || true # 检查 sing-box 配置 if ( cd "$(dirname "${sing_config}")" && "${bin_path}" check -c "$(basename "${sing_config}")" ) > "${box_run}/${bin_name}.log" 2>&1; then # 根据 network_mode 设置 auto_route if [[ "${network_mode}" == @(mixed|tun) ]]; then # 检查配置中是否有 "type": "tun" if ! busybox grep -q '"type": "tun"' "${sing_config}"; then # 若无则添加 "tun" 配置 ${yq} '.inbounds += [{ "type": "tun", "tag": "tun-in", "interface_name": "sing", "address": ["172.18.0.1/30","fdfe:dcba:9876::1/126"], "mtu": 9000, "stack": "mixed", "auto_route": true, "strict_route": true, "auto_redirect": true, "include_uid": [], "exclude_uid": [] }]' -i --output-format=json "${sing_config}" log Debug "已为 ${sing_config} 添加 [Tun] 配置" fi else # 非 tun 模式，关闭 auto_route # sed -i -e 's/auto_route": true/auto_route": false/g' -e 's/"auto_detect_interface": true/"auto_detect_interface": false/g' "${sing_config}" # 检查是否有 tproxy 配置 if ! busybox grep -q '"type": "tproxy"' "${sing_config}"; then # 若无则添加 tproxy 配置 ${yq} '.inbounds += [{"type": "tproxy", "tag": "tproxy-in", "listen": "::", "listen_port": '"${tproxy_port}"'}]' -i --output-format=json "${sing_config}" log Debug "已为 ${sing_config} 添加 [Tproxy] 配置" fi # 删除 tun 配置 ${yq} 'del(.inbounds[] | select(.type == "tun"))' -i --output-format=json "${sing_config}" # 同步 tproxy 端口 if busybox grep -q '"type": "tproxy"' "${sing_config}"; then ${yq} '(.inbounds[] | select(.type == "tproxy") | .listen_port) = '"${tproxy_port}" -i --output-format=json "${sing_config}" fi fi if [[ "${network_mode}" == @(mixed|tun) ]]; then # core 模式：跳过 UID 处理 if [ "${proxy_mode}" = "core" ]; then yq_filter='(.inbounds[] | select(.type == "tun") | .include_uid) = [] | (.inbounds[] | select(.type == "tun") | .exclude_uid) = []' "${yq}" eval "$yq_filter" -i --output-format=json "${sing_config}" > /dev/null 2>&1 log_service_results "sing-box" "core" "" else # 为 tun 添加 include_uid/exclude_uid 字段 yq_filter='(.inbounds[] | select(.type == "tun") | .include_uid) = [] | (.inbounds[] | select(.type == "tun") | .exclude_uid) = []' [[ ${proxy_mode} = "blacklist" || ${proxy_mode} = "black" ]] && mode="exclude" || mode="include" local uids_to_add="" if [ -s "${uid_list}" ]; then uids_to_add=$(busybox tr '\n' ',' < "${uid_list}" | sed 's/,$//') if [ -n "$uids_to_add" ]; then yq_filter="$yq_filter | (.inbounds[] | select(.type == \"tun\") | .${mode}_uid) = [${uids_to_add}]" fi fi "${yq}" eval "$yq_filter" -i --output-format=json "${sing_config}" > /dev/null 2>&1 log_service_results "sing-box" "$mode" "$uids_to_add" fi fi # 按 network_mode 添加 redirect 配置 if [[ "${network_mode}" == @(mixed|enhance|redirect) ]]; then if ! busybox grep -q '"type": "redirect"' "${sing_config}"; then # 若无则添加 redirect 配置 ${yq} '.inbounds += [{ "type": "redirect", "tag": "redirect-in", "listen": "::", "listen_port": '"${redir_port}"' }]' -i --output-format=json "${sing_config}" log Debug "已为 ${sing_config} 添加 [Redirect] 配置" fi # 同步 redir_port 端口 if busybox grep -q '"type": "redirect"' "${sing_config}"; then ${yq} '(.inbounds[] | select(.type == "redirect") | .listen_port) = '"${redir_port}" -i --output-format=json "${sing_config}" fi fi else log Error "$(<"${box_run}/${bin_name}.log")" log Error "配置失败，请检查 ${box_run}/${bin_name}.log 文件。" set_description error exit 1 fi } prepare_mihomo() { # 检查配置文件 if ! [ -f "${mihomo_config}" ]; then log Error "未找到配置文件 ${mihomo_config}" set_description error "配置文件不存在" exit 1 else log Info "检测到配置 ${mihomo_config}" fi # 写入 external_controller，如未配置 mihomo_external_controller=$(busybox awk '!/^ *#/ && /external-controller: /{print $1}' "${mihomo_config}") if [ -z "${mihomo_external_controller}" ]; then printf "\nexternal-controller: 0.0.0.0:9090" >> "${mihomo_config}" fi # 写入 external_ui，如未配置 mihomo_external_ui=$(busybox awk '!/^ *#/ && /external-ui: /{print $1}' "${mihomo_config}") if [ -z "${mihomo_external_ui}" ]; then printf "\nexternal-ui: ./dashboard" >> "${mihomo_config}" fi # 写入 tproxy-port，如未配置 mihomo_tproxy_port=$(busybox awk '!/^ *#/ && /tproxy-port: /{print $1}' "${mihomo_config}") if [ -z "${mihomo_tproxy_port}" ]; then printf "\ntproxy-port: ${tproxy_port}" >> "${mihomo_config}" fi # 写入 redir-port，如未配置 mihomo_redir_port=$(busybox awk '!/^ *#/ && /redir-port: /{print $1}' "${mihomo_config}") if [ -z "${mihomo_redir_port}" ]; then printf "\nredir-port: ${redir_port}" >> "${mihomo_config}" fi if [[ "${network_mode}" == @(mixed|tun) ]]; then mihomo_tun_status=$(busybox awk '!/^ *#/ && /tun:/ { getline; split($0, arr, ": "); print arr[2]; found=1; exit } END{ if (!found) print "" }' "${mihomo_config}" 2>/dev/null) # 写入 TUN 配置，如未配置 if [ -z "${mihomo_tun_status}" ]; then printf '%s\n' '' 'tun:' \ ' enable: true' \ ' mtu: 9000' \ ' device: meta' \ ' stack: mixed # / gvisor / system' \ ' dns-hijack:' \ ' - any:53' \ ' - tcp://any:53' \ ' auto-route: true' \ ' strict-route: true' \ ' auto-redirect: true' \ ' auto-detect-interface: true' \ ' include-android-user: [0, 10]' \ ' exclude-uid: []' \ ' include-uid: []' \ >> "${mihomo_config}" log Debug "已为 ${mihomo_config} 添加 [tun] 配置" else log Info "${mihomo_config} 已存在 [tun] 配置" fi # core 模式：跳过 UID 处理 if [ "${proxy_mode}" = "core" ]; then sed -i -e "s/exclude-uid:.*/exclude-uid: []/g" \ -e "s/include-uid:.*/include-uid: []/g" \ -e "/tun:/,/enable:/ { /enable: false/ s/enable: false/enable: true/ }" \ "${mihomo_config}" log_service_results "mihomo" "core" "" else # 为 tun 添加 include-uid/exclude-uid if [ -f "${uid_list}" ]; then list_uid=$(busybox tr '\n' ',' < "${uid_list}" | sed 's/,$//') else list_uid="" fi if [[ "${proxy_mode}" = "whitelist" || "${proxy_mode}" = "white" ]]; then mode="include" elif [[ "${proxy_mode}" = "blacklist" || "${proxy_mode}" = "black" ]]; then mode="exclude" fi # 重置 include/exclude_uid 列表并启用 tun sed -i -e "s/exclude-uid:.*/exclude-uid: []/g" \ -e "s/include-uid:.*/include-uid: []/g" \ -e "/tun:/,/enable:/ { /enable: false/ s/enable: false/enable: true/ }" \ "${mihomo_config}" # 检查 tun 块中是否有 include-uid/exclude-uid uid_found=$(busybox awk '/^tun:/{f=1} f && /'"$mode-uid:"'/{print $0; exit}' "$mihomo_config") if [ -z "$uid_found" ]; then sed -i "/^tun:/a \ $mode-uid: []" "$mihomo_config" fi # 添加uid到配置 if [ -n "${list_uid}" ]; then sed -i "s/${mode}-uid:.*/${mode}-uid: [${list_uid}]/g" "${mihomo_config}" fi log_service_results "mihomo" "$mode" "$list_uid" fi else sed -i "/tun:/,/enable:/ { /enable: true/ s/enable: true/enable: false/ }" "${mihomo_config}" fi # 同步 tproxy/redir 端口 sed -i -E "s/(tproxy-port: )[0-9]+/\1${tproxy_port}/" "${mihomo_config}" sed -i -E "s/(redir-port: )[0-9]+/\1${redir_port}/" "${mihomo_config}" mihomo_enhanced_mode=$(busybox awk '!/^ *#/ && /enhanced-mode: / { print $2 }' "${mihomo_config}" 2>/dev/null) if [ -z "${mihomo_enhanced_mode}" ]; then # 添加 enhanced-mode: fake-ip sed -i "/^dns:/a \ enhanced-mode: fake-ip" "$mihomo_config" log Debug "已添加 enhanced-mode: fake-ip" fi if [[ "${network_mode}" == @(mixed|tproxy|redirect|enhance) ]]; then if [[ "${proxy_mode}" != "core" ]] && [[ -n "${packages_list[*]}" || -n "${ignore_ap_list[*]}" || -n "${gid_list[*]}" ]] && [ "${mihomo_enhanced_mode}" = "fake-ip" ]; then log Warning "${proxy_mode} 仅在 mihomo 的 enhanced-mode: redir-host 下生效" log Warning "已将 fake-ip 替换为 redir-host" sed -i "s/enhanced-mode:.*/enhanced-mode: redir-host/g" "${mihomo_config}" sed -i "/sniffer:/,/enable:/ { /enable: false/ s/enable: false/enable: true/ }" "${mihomo_config}" fi fi } box_run_bin() { log Info "可用内核列表: [ ${bin_list[*]} ]" log Info "选择内核: ${bin_name}，启动服务。" ulimit -SHn 1000000 # 启动服务前刷新 box.tool 日志 : > "${box_run}/tool.log" case "${bin_name}" in hysteria) # 同步端口 if [ -f "${hysteria_config}" ]; then sed -i -e "/tcpTProxy:/,/listen:/s/listen: :.*/listen: :${tproxy_port}/" "${hysteria_config}" sed -i -e "/udpTProxy:/,/listen:/s/listen: :.*/listen: :${tproxy_port}/" "${hysteria_config}" sed -i -e "/tcpRedirect:/,/listen:/s/listen: :.*/listen: :${redir_port}/" "${hysteria_config}" fi # 验证 network_mode for hysteria case "${network_mode}" in redirect|tproxy|enhance) # 支持的模式，无需操作 ;; *) # 不支持的模式，切换回 tproxy sed -i 's/\(network_mode=\)"[^\"]*"/\1"tproxy"/g' ${settings} ;; esac nohup busybox setuidgid "${box_user_group}" "${bin_path}" -c "${hysteria_config}" > "${bin_log}" 2>&1 & PID=$! if kill -0 "${PID}" 2>/dev/null; then echo -n "${PID}" > "${box_pid}" else set_description error log Error "$(cat "${box_run}/${bin_name}.log")" log Error "配置失败，请检查 ${box_run}/${bin_name}.log 文件。" exit 1 fi ;; sing-box) if [ "${auto_modify_config}" = "true" ]; then prepare_singbox fi if ${bin_path} check -c "${sing_config}" -D "${box_dir}/${bin_name}" > "${box_run}/${bin_name}.log" 2>&1; then nohup busybox setuidgid "${box_user_group}" "${bin_path}" run -c "${sing_config}" -D "${box_dir}/${bin_name}" > "${bin_log}" 2>&1 & PID=$! echo -n $PID > "${box_pid}" else set_description error log Error "$(<"${box_run}/${bin_name}.log")" log Error "配置失败，请检查 ${box_run}/${bin_name}.log 文件。" exit 1 fi ;; mihomo) if [ "${auto_modify_config}" = "true" ]; then prepare_mihomo fi if ${bin_path} -t -d "${box_dir}/${bin_name}" -f "${mihomo_config}" > "${box_run}/${bin_name}.log" 2>&1; then nohup busybox setuidgid "${box_user_group}" "${bin_path}" -d "${box_dir}/${bin_name}" -f "${mihomo_config}" > "${bin_log}" 2>&1 & PID=$! echo -n $PID > "${box_pid}" else set_description error log Error "$(<"${box_run}/${bin_name}.log")" log Error "配置失败，请检查 ${box_run}/${bin_name}.log 文件。" exit 1 fi ;; xray) if [[ "${network_mode}" != "tproxy" ]]; then sed -i 's/\(network_mode=\)"[^\"]*"/\1"tproxy"/g' ${settings} fi if [ ! -f "${xray_config}" ]; then log Error "未找到配置文件：${xray_config}" set_description error "配置文件不存在" exit 1 else if [[ "${xray_config}" == *.yaml ]]; then ${box_dir}/bin/yq '(.inbounds[] | select(.protocol == "dokodemo-door") | .port) = '"${tproxy_port}"'' -i --output-format=yaml "${xray_config}" >/dev/null 2>&1 elif [[ "${xray_config}" == *.json ]]; then ${box_dir}/bin/yq '(.inbounds[] | select(.protocol == "dokodemo-door") | select(.tag == "tproxy-in") | .port) = '"${tproxy_port}" -i --output-format=json "${xray_config}" >/dev/null 2>&1 fi log Info "已定位配置文件：${xray_config}" fi export XRAY_LOCATION_ASSET="${box_dir}/${bin_name}" if ${bin_path} -test -confdir "${box_dir}/${bin_name}" > "${box_run}/${bin_name}.log" 2>&1; then nohup busybox setuidgid "${box_user_group}" "${bin_path}" run -confdir "${box_dir}/${bin_name}" > "${bin_log}" 2>&1 & PID=$! echo -n $PID > "${box_pid}" else set_description error log Error "$(<"${box_run}/${bin_name}.log")" log Error "配置失败，请检查 ${box_run}/${bin_name}.log 文件。" exit 1 fi ;; v2fly) if [[ "${network_mode}" != "tproxy" ]]; then sed -i 's/\(network_mode=\)"[^"]*"/\1"tproxy"/g' ${settings} fi if [ ! -f "${v2fly_config}" ]; then log Error "未找到配置文件：${v2fly_config}" set_description error "配置文件不存在" exit 1 else if [[ "${v2fly_config}" == *.yaml ]]; then ${box_dir}/bin/yq '(.inbounds[] | select(.protocol == "dokodemo-door") | .port) = '"${tproxy_port}"'' -i --output-format=yaml "${v2fly_config}" >/dev/null 2>&1 elif [[ "${v2fly_config}" == *.json ]]; then ${box_dir}/bin/yq '(.inbounds[] | select(.protocol == "dokodemo-door") | select(.tag == "tproxy-in") | .port) = '"${tproxy_port}" -i --output-format=json "${v2fly_config}" >/dev/null 2>&1 fi log Info "已定位配置文件：${v2fly_config}" fi export V2RAY_LOCATION_ASSET="${box_dir}/${bin_name}" if ${bin_path} test -d "${box_dir}/${bin_name}" > "${box_run}/${bin_name}.log" 2>&1; then nohup busybox setuidgid "${box_user_group}" "${bin_path}" run -d "${box_dir}/${bin_name}" > "${bin_log}" 2>&1 & PID=$! echo -n $PID > "${box_pid}" else set_description error log Error "$(<"${box_run}/${bin_name}.log")" log Error "配置失败，请检查 ${box_run}/${bin_name}.log 文件。" exit 1 fi ;; *) log Error "[ ${bin_name} ] 未知内核。" exit 1 ;; esac } box_cgroup() { set_cgroup_config() { local cgroup_attr="$1" local cgroup_value="$2" if [ "${cgroup_value}" = "true" ]; then if ${scripts_dir}/box.tool "${cgroup_attr}"; then true else log Warning "无法为 ${bin_name} 启用 ${cgroup_attr}" log Warning "已关闭 cgroups ${cgroup_attr}" sed -i -E "/cgroup_${cgroup_attr}/ s/(true)/false/" "${settings}" fi fi } set_cgroup_config "memcg" "${cgroup_memcg}" set_cgroup_config "cpuset" "${cgroup_cpuset}" set_cgroup_config "blkio" "${cgroup_blkio}" } # 显示进程状态信息 box_bin_status() { # 获取进程 PID local PID=$(busybox pidof ${bin_name}) if [ -z "$PID" ]; then log Error "${bin_name} 未在运行" return 1 fi stack=$(if [ "${bin_name}" != "mihomo" ]; then find "/data/adb/box/sing-box" -type f -name "*.json" -exec busybox awk -F'"' '/"stack"/{print $4}' {} +; else busybox awk '!/^ *#/ && /stack: / { print $2;found=1; exit}' "${mihomo_config}"; fi) TOAST=1 log Info "${bin_name} 服务正在运行" log Info "代理模式: ${proxy_mode} + 网络模式: ${network_mode} + $(if [[ "${network_mode}" == @(mixed|tun) ]]; then echo "协议栈: ${stack}"; fi)" # 获取内存使用情况 rss=$(grep VmRSS /proc/$PID/status | busybox awk '{ print $2 }') [ "${rss}" -ge 1024 ] && bin_rss="$(expr ${rss} / 1024) MB" || bin_rss="${rss} KB" swap=$(grep VmSwap /proc/$PID/status | busybox awk '{ print $2 }') [ "${swap}" -ge 1024 ] && bin_swap="$(expr ${swap} / 1024) MB" || bin_swap="${swap} KB" # 获取用户组信息 user_group=$(stat -c %U:%G /proc/$PID) # 记录信息到日志 log Info "${bin_name} 以 '${user_group}' 用户组启动" log Info "${bin_name} 状态: ${state} (PID: $PID)" log Info "${bin_name} 内存占用: ${bin_rss}, 交换: ${bin_swap}" # 获取 CPU 使用率 cpu=$(ps -p $PID -o %cpu | busybox awk 'NR==2{print $1}' 2>/dev/null) cpus_allowed=$(grep Cpus_allowed_list /proc/$PID/status | busybox awk '{ print $2" "$3 }') core=$(busybox awk '{print $39}' /proc/$PID/stat 2>/dev/null) if [ -n "${cpu}" ]; then log Info "${bin_name} CPU 使用率: ${cpu}%" else log Info "${bin_name} CPU 使用率: 无法获取" fi if [ -n "${cpus_allowed}" ]; then log Info "${bin_name} 允许使用的 CPU 核心: ${cpus_allowed}" log Info "${bin_name} 进程 $PID 最后运行在 CPU 核心: ${core}" else log Info "${bin_name} 运行的 CPU 核心: 无法获取" fi # 检查电池温度 temperature_celsius=$(($(cat /sys/class/power_supply/battery/temp) / 10)) log Info "电池温度: ${temperature_celsius}°C" # 获取运行时间 running_time=$(busybox ps -o comm,etime | grep ${bin_name} | busybox awk '{print $2}') if [ -n "${running_time}" ]; then log Info "${bin_name} 运行时间: ${running_time}" else log Info "${bin_name} 运行时间: 无法获取" fi ( # 本地 IP localIP=($(ip -4 a | awk '/inet / && !/127.0.0.1/ { split($2, a, "/"); print a[1] }')) log Info "本地 IP: ${localIP[*]}" # 本地 DNS localDNS=($(dumpsys connectivity | awk -F'[ ,]' '/DnsAddresses:/ { for (i=1; i<=NF; i++) if ($i ~ /^\/.*$/) { dns=substr($i, 2); if (dns ~ /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/) print dns } }')) log Info "本地 DNS: ${localDNS[*]}" ) & # 保存进程 ID 到 pid 文件 if [ -n "$PID" ]; then get_dns_mode set_description running echo -n "$PID" > "${box_pid}" fi } set_description() { local status="$1" local error_msg="$2" local desc="" local ipv6_info="" local wifi_match_str="" local ssid_mode_str="" local ssid_count=0 local bssid_count=0 # IPv6状态 if [ "${ipv6}" = "true" ]; then ipv6_info="已启用" else ipv6_info="未启用" fi # 仅在服务运行且启用网络控制且开启 WiFi 匹配（SSID/BSSID）时显示 if [ "$status" = "running" ] && [ "${enable_network_service_control}" = "true" ] && [ "${use_ssid_matching}" = "true" ]; then # 判断黑白名单模式 if [ "${use_wifi_list_mode}" = "blacklist" ]; then ssid_mode_str="黑名单" elif [ "${use_wifi_list_mode}" = "whitelist" ]; then ssid_mode_str="白名单" else ssid_mode_str="未知模式" fi ssid_count=0 for ssid_item in "${wifi_ssids_list[@]}"; do [ -n "$ssid_item" ] && ssid_count=$((ssid_count + 1)) done bssid_count=0 for bssid_item in "${wifi_bssids_list[@]}"; do [ -n "$bssid_item" ] && bssid_count=$((bssid_count + 1)) done wifi_match_str=" | WiFi匹配（${ssid_mode_str}）SSID:${ssid_count} BSSID:${bssid_count}" fi case "$status" in running) desc="✅ Box服务运行中 | 内核: ${bin_name} | 代理模式: ${proxy_mode} | 网络: ${network_mode} | IPv6状态: ${ipv6_info} | DNS模式: ${dns_mode}${wifi_match_str}" ;; stopped) desc="❌ Box服务已停止 | 上次运行内核: ${bin_name} | 代理已禁用" ;; idle) desc="✨ Box模块已加载，等待服务启动" ;; error) # 仅在出现配置错误时使用 local current_time current_time=$(date "+%Y-%m-%d %H:%M:%S") [ -z "${error_msg}" ] && error_msg="配置错误" desc="⚠️ Box ${error_msg} | 时间: ${current_time} | 内核: ${bin_name} | 详情见日志: ${box_run}/${bin_name}.log" ;; *) desc="💤 Box状态未知" ;; esac local escaped_desc escaped_desc=$(echo "${desc}" | sed -e 's/[&|#]/\\&/g') sed -Ei "s#^description=.*#description=${escaped_desc}#g" "$PROPFILE" } get_dns_mode() { dns_mode="未知" if [ "${bin_name}" = "mihomo" ]; then if grep -q "enhanced-mode: redir-host" "${mihomo_config}" 2>/dev/null; then dns_mode="redir-host" elif grep -q "enhanced-mode: fake-ip" "${mihomo_config}" 2>/dev/null; then dns_mode="fake-ip" fi elif [ "${bin_name}" = "sing-box" ]; then if grep -q '"type" *: *"fakeip"' "${sing_config}" 2>/dev/null; then dns_mode="fake-ip" else dns_mode="redir-host" fi fi export dns_mode } start_box() { find_packages_uid get_dns_mode set_description running echo -n "" > "${box_log}" box_version=$(busybox awk '!/^ *#/ && /version=/ { print $0 }' "/data/adb/modules/box_for_root/module.prop" 2>/dev/null) if [ -t 1 ]; then echo -e "${yellow}$(getprop persist.sys.timezone) $(date)${normal}" echo -e "${yellow}$(getprop gsm.sim.operator.alpha) $(getprop gsm.network.type)${normal}" echo -e "${yellow}${box_version}($(getprop ro.product.cpu.abi))${normal}" echo -e "${white}━━━━━━━━━━━━━━━━━━${normal}" else { echo "$(getprop persist.sys.timezone) $(date)" echo "$(getprop gsm.sim.operator.alpha) $(getprop gsm.network.type)" echo "${box_version}($(getprop ro.product.cpu.abi))" echo "━━━━━━━━━━━━━━━━━━" } | tee -a "${box_log}" >/dev/null 2>&1 fi # 如果 bin_name 仍在运行则更新 iptables PIDS=("${bin_list[@]}") PID="" i=0 while [ -z "$PID" ] && [ "$i" -lt "${#PIDS[@]}" ]; do PID=$(busybox pidof "${PIDS[$i]}") i=$((i+1)) done if [ -n "$PID" ]; then pid_name="${box_dir}/run/pid_name.txt" ps -p $PID -o comm= > "${pid_name}" sed -i '/^[[:space:]]*$/d' "${pid_name}" log Debug "$(<"${pid_name}")(PID: $PID) 服务仍在运行，自动重启 BOX" rm -f "${pid_name}" stop_box start_box && "${scripts_dir}/box.iptables" renew exit 1 fi # 检查 bin_name 是否已定义 case "${bin_name}" in mihomo|xray|sing-box|v2fly|hysteria) log Info "启动服务" ;; *) log Error "bin_name: [ ${bin_name} ] 未定义或未知" exit 1 ;; esac # busybox 检查 busybox_code=$(busybox | busybox grep -oE '[0-9.]*' | head -n 1) if [ -n "${busybox_code}" ] && [ "$(echo "${busybox_code}" | busybox awk -F. '{printf "%03d%03d%03d\n", $1, $2, $3}')" -lt "$(echo "1.36.1" | busybox awk -F. '{printf "%03d%03d%03d\n", $1, $2, $3}')" ]; then log Info "当前 $(which busybox) v${busybox_code}" log Warning "请将 busybox 更新到 v1.36.1+" else log Info "当前 $(which busybox) v${busybox_code}" fi box_permission box_check_bin box_check_logs # 如果 run_crontab 不等于 "false" 则执行 box_run_crontab [ "${run_crontab}" = "true" ] && box_run_crontab || log Info "定时任务已禁用" if [ -z "${proxy_mode}" ]; then M1=$(busybox awk '!/^ *#/ && /mode:/{print $0}' "${pkg_config}") [ -z $M1 ] && printf "\nmode:white" >> "${pkg_config}" log Debug "代理模式为空，在 ${pkg_config} 中添加 mode:white" fi # 执行 box_cgroup, box_run_bin, box_detected_port, box_bin_alive 函数 box_run_bin box_cgroup count=0 while [ $count -le 5 ]; do box_bin_alive || break count=$((count + 1)) done true } stop_box() { stop_cron for bin in "${bin_list[@]}"; do if busybox pgrep "${bin}" >/dev/null; then if busybox pkill -15 "${bin}" >/dev/null; then : else killall -15 "${bin}" >/dev/null 2>&1 || kill -15 "$(busybox pidof "${bin}")" >/dev/null 2>&1 fi fi done count=0 while [ $count -lt 3 ]; do if ! busybox pidof "${bin_name}" >/dev/null 2>&1; then break fi sleep 1 count=$((count + 1)) done if ! busybox pidof "${bin_name}" >/dev/null; then if [ -f "${box_pid}" ]; then rm -f "${box_pid}" fi log Warning "${bin_name} 已关闭，服务已停止。" TOAST=1 log Warning "${bin_name} 已断开连接。" [ -t 1 ] && echo -e "${white}━━━━━━━━━━━━━━━━━━${normal}" else log Warning "${bin_name} 未完全停止，可能正在关闭或关闭失败。" force_stop fi set_description stopped } stop_cron() { if ! busybox pkill -f "busybox crond" >/dev/null 2>&1; then cronkill=$(busybox pgrep -f "crond -c ${box_run}") for cron in ${cronkill}; do kill -15 "${cron}" >/dev/null 2>&1 done fi } force_stop() { log Warning "尝试强制关闭" local PID PID=$(cat "${box_pid}" 2>/dev/null) if [ -n "$PID" ] && kill -0 "$PID" 2>/dev/null; then kill -9 "$PID" >/dev/null 2>&1 else for bin in "${bin_list[@]}"; do busybox pkill -9 "${bin}" >/dev/null 2>&1 done fi if ! busybox pgrep -f "${bin_name}" >/dev/null 2>&1; then log Warning "完成，现在可以安心休息了" rm -f "${box_pid}" fi } # 检查系统是否安装了 busybox if ! command -v busybox &> /dev/null; then log Error "$(which busybox) 命令未找到" exit 1 fi case "$1" in start) stop_box >/dev/null 2>&1 if start_box; then $scripts_dir/box.tool webroot >/dev/null 2>&1 fi ;; stop) stop_box ;; restart) "${scripts_dir}/box.iptables" disable && stop_box if start_box; then "${scripts_dir}/box.iptables" renew $scripts_dir/box.tool webroot >/dev/null 2>&1 fi ;; status) # 检查服务是否在运行 if busybox pidof "${bin_name}" >/dev/null; then case "${bin_name}" in mihomo) echo "${yellow}$("${bin_path}" -v)${normal}";; *) echo "${yellow}$("${bin_path}" version)${normal}";; esac box_bin_status else log Warning "${bin_name} 已关闭，服务已停止" fi ;; cron) run_crontab="true" stop_cron box_run_crontab ;; kcron) stop_cron ;; *) echo "${red}$0 '$1' 未找到${normal}" >&2 echo "${yellow}用法${normal}: ${green}$0${normal} {${yellow}start|stop|restart|status|cron|kcron${normal}}" >&2 ;; esacbox-debug/box/scripts/box.tool000077500000000000000000001353701516412072700167210ustar00rootroot00000000000000#!/system/bin/sh scripts_dir="${0%/*}" user_agent="box_for_root" source /data/adb/box/settings.ini # 使用 settings.ini 中提供的 log() TOOL_LOG="${box_run}/tool.log" busybox mkdir -p "$(dirname "$TOOL_LOG")" box_log="$TOOL_LOG" # 设置 GitHub API 访问配置 setup_github_api() { rev1="busybox wget --no-check-certificate -qO-" if which curl >/dev/null; then rev1="curl --insecure -sL" fi if [ -n "$githubtoken" ]; then if which curl >/dev/null; then rev1="curl --insecure -sL -H \"Authorization: token ${githubtoken}\"" else rev1="busybox wget --no-check-certificate -qO- --header=\"Authorization: token ${githubtoken}\"" fi log Debug "GitHub Token 已配置，将使用认证访问 GitHub API" else log Debug "未配置 GitHub Token，将使用匿名访问 GitHub API" fi } mask_url() { local u="$1" echo "$u" | sed -E 's#^([a-zA-Z][a-zA-Z0-9+.-]*://)?([^/]+).*$#\1\2/***#' } # 启动提示 divider() { local line="----------------------------------------" [ -n "$box_log" ] && echo "$line" >> "$box_log" } trap divider EXIT log Info "执行命令: $0 $@" # 更新文件 upfile() { local file="$1" local update_url="$2" local custom_ua="$3" # 接收自定义 User-Agent local current_ua # 如果提供了自定义 UA, 则使用它; 否则使用全局默认值 if [ -n "${custom_ua}" ]; then current_ua="${custom_ua}" else current_ua="${user_agent}" fi local file_bak="${file}.bak" [ -f "${file}" ] && mv "${file}" "${file_bak}" # 使用 ghproxy if [ "${use_ghproxy}" = "true" ] && [[ "${update_url}" == @(https://github.com/*|https://raw.githubusercontent.com/*|https://gist.github.com/*|https://gist.githubusercontent.com/*) ]]; then update_url="${url_ghproxy}/${update_url}" fi log_url="${update_url}" if [ "${LOG_MASK_URL}" = "mask" ]; then log_url="$(mask_url "${update_url}")" fi log Info "开始下载: ${log_url}" log Debug "保存到: ${file}" log Debug "使用 User-Agent: ${current_ua}" if which curl >/dev/null; then http_code=$(curl -L -s --insecure --http1.1 --compressed --user-agent "${current_ua}" -o "${file}" -w "%{http_code}" "${update_url}") curl_exit_code=$? if [ ${curl_exit_code} -ne 0 ]; then log Error "使用 curl 下载失败 (退出码: ${curl_exit_code})" [ -f "${file_bak}" ] && mv "${file_bak}" "${file}" return 1 fi if [ "${http_code}" -ne 200 ]; then log Error "下载失败: 服务器返回 HTTP 状态码 ${http_code}" [ -f "${file_bak}" ] && mv "${file_bak}" "${file}" return 1 fi else if ! busybox wget --no-check-certificate -q -U "${current_ua}" -O "${file}" "${update_url}"; then log Error "使用 wget 下载失败" [ -f "${file_bak}" ] && mv "${file_bak}" "${file}" return 1 fi fi if [ ! -s "${file}" ]; then log Error "下载失败: 文件为空" [ -f "${file_bak}" ] && mv "${file_bak}" "${file}" return 1 fi log Info "下载成功" rm -f "${file_bak}" 2>/dev/null return 0 } # CN IPv4/IPv6 列表更新 upcnip() { local did_any=false # IPv4 if [ "${bypass_cn_ip}" = "true" ] && [ "${bypass_cn_ip_v4}" = "true" ]; then if [ -z "${cn_ip_url}" ] || [ -z "${cn_ip_file}" ]; then log Warning "cn_ip_url 或 cn_ip_file 未配置，跳过 IPv4" else log Info "下载 CN IPv4 列表 → ${cn_ip_file}" if upfile "${cn_ip_file}" "${cn_ip_url}"; then log Info "CN IPv4 列表更新完成" did_any=true else log Error "CN IPv4 列表更新失败" fi fi else log Debug "未启用 IPv4 CN 分流（bypass_cn_ip/bypass_cn_ip_v4=false），跳过下载" fi # IPv6 if [ "${bypass_cn_ip}" = "true" ] && [ "${ipv6}" = "true" ] && [ "${bypass_cn_ip_v6}" = "true" ]; then if [ -z "${cn_ipv6_url}" ] || [ -z "${cn_ipv6_file}" ]; then log Warning "cn_ipv6_url 或 cn_ipv6_file 未配置，跳过 IPv6" else log Info "下载 CN IPv6 列表 → ${cn_ipv6_file}" if upfile "${cn_ipv6_file}" "${cn_ipv6_url}"; then log Info "CN IPv6 列表更新完成" did_any=true else log Error "CN IPv6 列表更新失败" fi fi else log Debug "未启用 IPv6 CN 分流或未开启 IPv6，跳过下载" fi $did_any && return 0 || return 1 } # 重启核心进程 restart_box() { local core_to_restart=${1:-$bin_name} if [ -z "$core_to_restart" ]; then log Error "restart_box: 未指定需要重启的核心" return 1 fi "${scripts_dir}/box.service" restart "$core_to_restart" local pid pid=$(busybox pidof "$core_to_restart") if [ -n "$pid" ]; then log Info "$core_to_restart 重启完成 [$(date +"%F %R")]" else log Error "重启 $core_to_restart 失败." "${scripts_dir}/box.iptables" disable >/dev/null 2>&1 fi } # 检查配置 check() { case "${bin_name}" in sing-box) if ${bin_path} check -c "${sing_config}" > "${box_run}/${bin_name}_report.log" 2>&1; then log Info "${sing_config} 检查通过" else log Debug "${sing_config}" log Error "$(<"${box_run}/${bin_name}_report.log")" >&2 fi ;; mihomo) if ${bin_path} -t -d "${box_dir}/mihomo" -f "${mihomo_config}" > "${box_run}/${bin_name}_report.log" 2>&1; then log Info "${mihomo_config} 检查通过" else log Debug "${mihomo_config}" log Error "$(<"${box_run}/${bin_name}_report.log")" >&2 fi ;; xray) export XRAY_LOCATION_ASSET="${box_dir}/xray" if ${bin_path} -test -confdir "${box_dir}/${bin_name}" > "${box_run}/${bin_name}_report.log" 2>&1; then log Info "配置检查通过" else log Debug "$(ls ${box_dir}/${bin_name})" log Error "$(<"${box_run}/${bin_name}_report.log")" >&2 fi ;; v2fly) export V2RAY_LOCATION_ASSET="${box_dir}/v2fly" if ${bin_path} test -d "${box_dir}/${bin_name}" > "${box_run}/${bin_name}_report.log" 2>&1; then log Info "配置检查通过" else log Debug "$(ls ${box_dir}/${bin_name})" log Error "$(<"${box_run}/${bin_name}_report.log")" >&2 fi ;; hysteria) true ;; *) log Error "<${bin_name}> 未知的二进制文件." exit 1 ;; esac } # 重载基础配置 reload() { ip_port=$(if [ "${bin_name}" = "mihomo" ]; then busybox awk '/external-controller:/ {print $2}' "${mihomo_config}" | sed "s/'//g"; else busybox awk -F'[:,]' '/"external_controller"/ {print $2":"$3}' "${sing_config}" | sed 's/^[ \t]*//;s/"//g'; fi;) secret=$(if [ "${bin_name}" = "mihomo" ]; then busybox awk '/^secret:/ {print $2}' "${mihomo_config}" | sed 's/"//g'; else busybox awk -F'"' '/"secret"/ {print $4}' "${sing_config}" | head -n 1; fi;) curl_command="curl" if ! command -v curl >/dev/null; then if [ ! -e "${bin_dir}/curl" ]; then log Debug "$bin_dir/curl 文件未找到, 无法重载配置" log Debug "开始从 GitHub 下载" upcurl || exit 1 fi curl_command="${bin_dir}/curl" fi check case "${bin_name}" in "mihomo") endpoint="http://${ip_port}/configs?force=true" if ${curl_command} -X PUT -H "Authorization: Bearer ${secret}" "${endpoint}" -d '{"path": "", "payload": ""}' 2>&1; then log Info "${bin_name} 配置重载成功" return 0 else log Error "${bin_name} 配置重载失败 !" return 1 fi ;; "sing-box") endpoint="http://${ip_port}/configs?force=true" if ${curl_command} -X PUT -H "Authorization: Bearer ${secret}" "${endpoint}" -d '{"path": "", "payload": ""}' 2>&1; then log Info "${bin_name} 配置重载成功." return 0 else log Error "${bin_name} 配置重载失败 !" return 1 fi ;; "xray"|"v2fly"|"hysteria") if [ -f "${box_pid}" ]; then if kill -0 "$(<"${box_pid}" 2>/dev/null)"; then restart_box fi fi ;; *) log Warning "${bin_name} 不支持使用 API 重载配置." return 1 ;; esac } # 获取最新的 curl upcurl() { setup_github_api local arch case $(uname -m) in "aarch64") arch="aarch64" ;; "armv7l"|"armv8l") arch="armv7" ;; "i686") arch="i686" ;; "x86_64") arch="amd64" ;; *) log Warning "不支持的架构: $(uname -m)" >&2; return 1 ;; esac mkdir -p "${bin_dir}/backup" [ -f "${bin_dir}/curl" ] && cp "${bin_dir}/curl" "${bin_dir}/backup/curl.bak" >/dev/null 2>&1 local latest_version=$($rev1 "https://api.github.com/repos/stunnel/static-curl/releases" | grep "tag_name" | busybox grep -oE "[0-9.]*" | head -1) local download_link="https://github.com/stunnel/static-curl/releases/download/${latest_version}/curl-linux-${arch}-glibc-${latest_version}.tar.xz" local temp_archive="${box_dir}/curl.tar.xz" local temp_extract_dir="${box_dir}/curl_temp" log Debug "下载 ${download_link}" if ! upfile "${temp_archive}" "${download_link}"; then log Error "下载 curl 失败" return 1 fi rm -rf "${temp_extract_dir}" mkdir -p "${temp_extract_dir}" if ! busybox tar -xJf "${temp_archive}" -C "${temp_extract_dir}" >&2; then log Error "解压 ${temp_archive} 失败" >&2 cp "${bin_dir}/backup/curl.bak" "${bin_dir}/curl" >/dev/null 2>&1 && log Info "已恢复 curl" rm -f "${temp_archive}" rm -rf "${temp_extract_dir}" return 1 fi local curl_binary=$(find "${temp_extract_dir}" -type f -name "curl") if [ -n "${curl_binary}" ]; then mv "${curl_binary}" "${bin_dir}/curl" log Info "curl 已成功更新到 ${bin_dir}/curl" else log Error "在解压的存档中未找到 curl 二进制文件" rm -f "${temp_archive}" rm -rf "${temp_extract_dir}" return 1 fi chown "${box_user_group}" "${box_dir}/bin/curl" chmod 0755 "${bin_dir}/curl" rm -f "${temp_archive}" rm -rf "${temp_extract_dir}" } # 获取最新的 yq upyq() { local arch platform case $(uname -m) in "aarch64") arch="arm64"; platform="android" ;; "armv7l"|"armv8l") arch="arm"; platform="android" ;; "i686") arch="386"; platform="android" ;; "x86_64") arch="amd64"; platform="android" ;; *) log Warning "不支持的架构: $(uname -m)" >&2; return 1 ;; esac local download_link="https://github.com/taamarin/yq/releases/download/prerelease/yq_${platform}_${arch}" log Debug "下载 ${download_link}" upfile "${box_dir}/bin/yq" "${download_link}" chown "${box_user_group}" "${box_dir}/bin/yq" chmod 0755 "${box_dir}/bin/yq" } # 检查并更新 geoip 和 geosite upgeox() { geodata_mode=$(busybox awk '!/^ *#/ && /geodata-mode:*./{print $2}' "${mihomo_config}") [ -z "${geodata_mode}" ] && geodata_mode=false case "${bin_name}" in mihomo) geoip_file="${box_dir}/mihomo/Country.mmdb" geoip_url="https://github.com/MetaCubeX/meta-rules-dat/raw/release/country-lite.mmdb" geosite_file="${box_dir}/mihomo/GeoSite.dat" geosite_url="https://github.com/MetaCubeX/meta-rules-dat/raw/release/geosite.dat" ;; sing-box) geoip_file="${box_dir}/sing-box/geoip.db" geoip_url="https://github.com/MetaCubeX/meta-rules-dat/raw/release/geoip-lite.db" geosite_file="${box_dir}/sing-box/geosite.db" geosite_url="https://github.com/MetaCubeX/meta-rules-dat/raw/release/geosite.db" ;; *) geoip_file="${box_dir}/${bin_name}/geoip.dat" geoip_url="https://github.com/MetaCubeX/meta-rules-dat/raw/release/geoip-lite.dat" geosite_file="${box_dir}/${bin_name}/geosite.dat" geosite_url="https://github.com/MetaCubeX/meta-rules-dat/raw/release/geosite.dat" ;; esac if [ "${update_geo}" = "true" ] && { log Info "每日更新 GeoX" && log Debug "正在下载 ${geoip_url}"; } && upfile "${geoip_file}" "${geoip_url}" && { log Debug "正在下载 ${geosite_url}" && upfile "${geosite_file}" "${geosite_url}"; }; then find "${box_dir}/${bin_name}" -maxdepth 1 -type f -name "*.db.bak" -delete find "${box_dir}/${bin_name}" -maxdepth 1 -type f -name "*.dat.bak" -delete find "${box_dir}/${bin_name}" -maxdepth 1 -type f -name "*.mmdb.bak" -delete log Debug "更新 GeoX 于 $(date "+%F %R")" return 0 else return 1 fi } upgeox_all() { local original_bin_name=$bin_name for core in mihomo sing-box xray v2fly; do bin_name=$core upgeox done bin_name=$original_bin_name } # 更新 mihomo 配置的 proxy-providers update_mihomo_providers() { yq="yq" if ! command -v yq &>/dev/null; then if [ ! -e "${box_dir}/bin/yq" ]; then log Debug "yq 文件未找到, 开始从 GitHub 下载" ${scripts_dir}/box.tool upyq fi yq="${box_dir}/bin/yq" fi if [ ! -f "${mihomo_config}" ]; then log Error "配置文件不存在: ${mihomo_config}" return 1 fi cp "${mihomo_config}" "${mihomo_config}.bak" 2>/dev/null local file_count=${#name_provide_mihomo_config[@]} if [ "$file_count" -eq 0 ]; then log Warning "没有配置的订阅文件" return 1 fi log Debug "开始更新 proxy-providers 配置项..." local config_dir="$(dirname "${mihomo_config}")" local temp_providers="${mihomo_config}.providers.tmp" echo "proxy-providers:" > "${temp_providers}" for i in $(seq 0 $((file_count - 1))); do local file_name="${name_provide_mihomo_config[$i]}" local provider_file="${mihomo_provide_path}/${file_name}" local provider_name="${file_name%.yaml}" local provider_url="${subscription_url_mihomo[$i]}" local escaped_url if [ -z "${provider_url}" ]; then log Warning "订阅链接为空，跳过: ${provider_name}" continue fi escaped_url="$(echo "${provider_url}" | busybox sed 's/\\/\\\\/g; s/\"/\\"/g')" local relative_path if command -v realpath >/dev/null 2>&1 && [ -e "${provider_file}" ]; then relative_path="$(realpath --relative-to="${config_dir}" "${provider_file}")" [ -z "${relative_path}" ] && relative_path="./$(basename "${mihomo_provide_path}")/${file_name}" else relative_path="./$(basename "${mihomo_provide_path}")/${file_name}" fi log Debug "添加 provider: ${provider_name} -> ${relative_path} (http)" cat >> "${temp_providers}" < 0) { print line } close(new_providers) providers_done = 1 } next } in_providers == 1 && /^[a-zA-Z-]+:/ { in_providers = 0 print next } in_providers == 1 { next } { print } END { if (providers_done == 0) { while ((getline line < new_providers) > 0) { print line } close(new_providers) } } ' "${mihomo_config}" > "${temp_output}" mv "${temp_output}" "${mihomo_config}" rm -f "${temp_providers}" log Debug "proxy-providers 配置构建完成" return 0 } # 检查并更新订阅 upsubs() { if [ "${update_subscription}" != "true" ]; then log Warning "更新订阅已禁用: update_subscription=\"${update_subscription}\"" return 1 fi yq="yq" if ! command -v yq &>/dev/null; then if [ ! -e "${box_dir}/bin/yq" ]; then log Debug "yq 文件未找到, 开始从 GitHub 下载" ${scripts_dir}/box.tool upyq fi yq="${box_dir}/bin/yq" fi case "${bin_name}" in "mihomo") local url_count=${#subscription_url_mihomo[@]} local file_count=${#name_provide_mihomo_config[@]} if [ "$url_count" -eq 0 ]; then log Warning "${bin_name} 订阅链接为空" return 1 fi if [ "$url_count" -ne "$file_count" ]; then log Error "订阅链接数量 (${url_count}) 与文件名数量 (${file_count}) 不匹配!" return 1 fi log Info "${bin_name} 开始更新 ${url_count} 个订阅 → $(date)" if [ -z "${mihomo_provide_path}" ] || ! mkdir -p "${mihomo_provide_path}"; then log Error "mihomo_provide_path 未定义或无法创建目录!" return 1 fi local success_count=0 local update_failed=false local rules_extracted=false for i in $(seq 0 $((url_count - 1))); do local url="${subscription_url_mihomo[$i]}" local file_name="${name_provide_mihomo_config[$i]}" local provider_file="${mihomo_provide_path}/${file_name}" log Info "--> 正在处理订阅 #${i}: ${file_name}" if [ "${renew}" = "true" ] && [ "$i" -eq 0 ]; then log Info "检测到 renew=true, 仅使用第一个订阅链接更新" if LOG_MASK_URL=mask upfile "${mihomo_config}" "${url}" "ClashMeta"; then log Info "${mihomo_config} 更新成功" if [ -f "${box_pid}" ]; then kill -0 "$(<"${box_pid}" 2>/dev/null)" && \ $scripts_dir/box.service restart 2>/dev/null fi log Info "${bin_name} 订阅更新完成 → $(date)" exit 0 else log Error "${mihomo_config} 更新失败" exit 1 fi fi if LOG_MASK_URL=mask upfile "${provider_file}" "${url}" "ClashMeta"; then log Debug "文件大小: $(wc -c < "${provider_file}" 2>/dev/null || echo "未知") 字节" log Debug "文件路径: ${provider_file}" local decoded_content decoded_content=$(base64 -d "${provider_file}" 2>/dev/null) if [ $? -eq 0 ] && echo "${decoded_content}" | grep -qE "vless://|vmess://|ss://|hysteria://|hysteria2://|anytls://|trojan://"; then log Info "检测到 Base64 编码订阅, 正在解码..." echo "${decoded_content}" > "${provider_file}" local proxy_count=$(echo "${decoded_content}" | grep -cE "vless://|vmess://|ss://|hysteria://|hysteria2://|anytls://|trojan://") log Debug "提取到 ${proxy_count} 个代理节点" log Info "订阅 #${i} (Base64解码/原始链接) 已保存" success_count=$((success_count + 1)) elif ${yq} 'has("proxies")' "${provider_file}" 2>/dev/null; then if [ "${custom_rules_subs}" = "true" ] && [ "$rules_extracted" = "false" ]; then if ${yq} 'has("rules")' "${provider_file}" &>/dev/null; then log Info "在 ${file_name} 中找到规则, 正在提取..." ${yq} '.rules' "${provider_file}" > "${mihomo_provide_rules}" ${yq} -i '{"rules": .}' "${mihomo_provide_rules}" log Info "规则已提取到 ${mihomo_provide_rules}" rules_extracted=true fi fi log Debug "标准订阅格式, 正在提取 proxies 并覆盖原文件..." local temp_proxies_file temp_proxies_file=$(mktemp) # 提取 proxies 数组并验证 log Debug "尝试提取 proxies 字段..." if ${yq} '.proxies' "${provider_file}" > "${temp_proxies_file}" 2>/dev/null; then if [ -s "${temp_proxies_file}" ]; then local proxy_count=$(${yq} 'length' "${temp_proxies_file}" 2>/dev/null || echo "0") log Debug "提取到 ${proxy_count} 个代理节点" ${yq} -i '{"proxies": .}' "${temp_proxies_file}" mv "${temp_proxies_file}" "${provider_file}" log Info "订阅 #${i} (标准格式) 已处理并保存" success_count=$((success_count + 1)) else log Error "订阅 #${i} (${file_name}) proxies 字段为空" rm -f "${temp_proxies_file}" "${provider_file}" update_failed=true fi else log Error "订阅 #${i} (${file_name}) yq 提取 proxies 失败" rm -f "${temp_proxies_file}" "${provider_file}" update_failed=true fi elif ${yq} '.. | select(tag == "!!str")' "${provider_file}" 2>/dev/null | grep -qE "vless://|vmess://|ss://|hysteria://|hysteria2://|anytls://|trojan://"; then local proxy_count=$(${yq} '.. | select(tag == "!!str")' "${provider_file}" 2>/dev/null | grep -cE "vless://|vmess://|ss://|hysteria://|hysteria2://|anytls://|trojan://") log Debug "提取到 ${proxy_count} 个代理节点" log Info "订阅 #${i} (原始链接) 已保存" success_count=$((success_count + 1)) else log Error "订阅 #${i} (${file_name}) 格式无法识别或内容为空, 已删除" rm -f "${provider_file}" update_failed=true fi else log Error "订阅 #${i} (${file_name}) 下载失败" update_failed=true fi done log Info "成功更新 ${success_count} / ${url_count} 个订阅" if [ "${renew}" != "true" ] && [ "${success_count}" -gt 0 ]; then if [ "${auto_modify_config}" = "true" ]; then log Info "正在更新 ${name_mihomo_config} 的 proxy-providers 配置..." if update_mihomo_providers; then log Info "proxy-providers 配置更新成功" else log Warning "proxy-providers 配置更新失败，请手动检查配置文件" fi else log Info "auto_modify_config 未启用，跳过更新 proxy-providers 配置" fi fi if [ "${update_failed}" = "true" ]; then log Error "部分订阅链接更新失败" return 1 else log Info "更新订阅于 $(date +"%F %R")" return 0 fi ;; "sing-box") update_file_name="${sing_config}" if [ -n "${subscription_url_singbox}" ]; then log Info "${bin_name} 每日更新订阅 → $(date)" log Debug "正在下载 ${update_file_name}" if upfile "${update_file_name}" "${subscription_url_singbox}" "sing-box"; then log Info "${update_file_name} 已保存" log Info "更新订阅于 $(date +"%F %R")" if [ -f "${box_pid}" ]; then kill -0 "$(<"${box_pid}" 2>/dev/null)" && \ $scripts_dir/box.service restart 2>/dev/null fi return 0 else log Error "更新订阅失败" return 1 fi else log Warning "${bin_name} 订阅链接为空..." return 1 fi ;; "xray"|"v2fly"|"hysteria") log Warning "${bin_name} 不支持订阅功能.." return 1 ;; *) log Error "<${bin_name}> 未知的二进制文件." return 1 ;; esac } upkernel() { setup_github_api local core_to_update="$1" if [ -z "$core_to_update" ]; then log Error "upkernel: 未提供核心名称" return 1 fi mkdir -p "${bin_dir}/backup" if [ -f "${bin_dir}/${core_to_update}" ]; then cp "${bin_dir}/${core_to_update}" "${bin_dir}/backup/${core_to_update}.bak" >/dev/null 2>&1 fi case $(uname -m) in "aarch64") if [ "$core_to_update" = "mihomo" ]; then arch="arm64-v8" else arch="arm64" fi platform="android" ;; "armv7l"|"armv8l") arch="armv7"; platform="linux" ;; "i686") arch="386"; platform="linux" ;; "x86_64") arch="amd64"; platform="linux" ;; *) log Warning "不支持的架构: $(uname -m)" >&2; return 1 ;; esac local file_kernel="${core_to_update}-${arch}" case "${core_to_update}" in "mihomo_smart") log Info "正在更新 mihomo-smart 核心 (来自 vernesong/mihomo)" local arch_smart case $(uname -m) in "aarch64") arch_smart="arm64-v8" ;; *) log Error "mihomo-smart 当前仅支持 aarch64 架构"; return 1 ;; esac local release_page_url="https://github.com/vernesong/mihomo/releases/expanded_assets/Prerelease-Alpha" [ "${use_ghproxy}" = "true" ] && release_page_url="${url_ghproxy}/${release_page_url}" local smart_version_tag=$($rev1 "${release_page_url}" | busybox grep -oE "smart-[a-f0-9]+" | head -1) if [ -z "$smart_version_tag" ]; then log Error "获取 mihomo-smart 最新版本标签失败" return 1 fi local download_link="https://github.com/vernesong/mihomo/releases/download/Prerelease-Alpha/mihomo-android-${arch_smart}-alpha-${smart_version_tag}.gz" local file_kernel="${core_to_update}-${arch_smart}" log Debug "下载 ${download_link}" upfile "${box_dir}/${file_kernel}.gz" "${download_link}" && xkernel "$core_to_update" "" "" "" "$file_kernel" ;; "sing-box") api_url="https://api.github.com/repos/SagerNet/sing-box/releases" url_down="https://github.com/SagerNet/sing-box/releases" if [ "${singbox_stable}" = "disable" ]; then log Debug "下载 ${core_to_update} 预发行版" latest_version=$($rev1 "${api_url}" | grep "tag_name" | busybox grep -oE "v[0-9].*" | head -1 | cut -d'"' -f1) else log Debug "下载 ${core_to_update} 最新稳定版" latest_version=$($rev1 "${api_url}/latest" | grep "tag_name" | busybox grep -oE "v[0-9.]*" | head -1) fi if [ -z "$latest_version" ]; then log Error "获取 sing-box 最新 稳定版/测试版/Alpha版 失败" return 1 fi download_link="${url_down}/download/${latest_version}/sing-box-${latest_version#v}-${platform}-${arch}.tar.gz" log Debug "下载 ${download_link}" upfile "${box_dir}/${file_kernel}.tar.gz" "${download_link}" && xkernel "$core_to_update" "$platform" "$arch" "$latest_version" "$file_kernel" ;; "mihomo") download_link="https://github.com/MetaCubeX/mihomo/releases" if [ "${mihomo_stable}" = "enable" ]; then latest_version=$($rev1 "https://api.github.com/repos/MetaCubeX/mihomo/releases" | grep "tag_name" | busybox grep -oE "v[0-9.]*" | head -1) tag="$latest_version" else if [ "$use_ghproxy" == true ]; then download_link="${url_ghproxy}/${download_link}" fi tag="Prerelease-Alpha" latest_version=$($rev1 "${download_link}/expanded_assets/${tag}" | busybox grep -oE "alpha-[0-9a-z]+" | head -1) fi if [ -z "$latest_version" ]; then log Error "获取 mihomo 最新 稳定版/预发行版 失败" return 1 fi local extension="gz" if [ "${platform}" = "android" ]; then extension="zip" fi filename="mihomo-${platform}-${arch}-${latest_version}" log Debug "下载 ${download_link}/download/${tag}/${filename}.gz" upfile "${box_dir}/${file_kernel}.gz" "${download_link}/download/${tag}/${filename}.gz" && xkernel "$core_to_update" "" "" "" "$file_kernel" ;; "xray"|"v2fly") [ "${core_to_update}" = "xray" ] && bin='Xray' || bin='v2ray' api_url="https://api.github.com/repos/$(if [ "${core_to_update}" = "xray" ]; then echo "XTLS/Xray-core/releases"; else echo "v2fly/v2ray-core/releases"; fi)" latest_version=$($rev1 ${api_url} | grep "tag_name" | busybox grep -oE "v[0-9.]*" | head -1) if [ -z "$latest_version" ]; then log Error "获取 ${core_to_update} 最新版本号失败" return 1 fi case $(uname -m) in "i386") download_file="$bin-linux-32.zip" ;; "x86_64") download_file="$bin-linux-64.zip" ;; "armv7l"|"armv8l") download_file="$bin-linux-arm32-v7a.zip" ;; "aarch64") download_file="$bin-android-arm64-v8a.zip" ;; *) log Error "不支持的架构: $(uname -m)" >&2; return 1 ;; esac download_link="https://github.com/$(if [ "${core_to_update}" = "xray" ]; then echo "XTLS/Xray-core/releases"; else echo "v2fly/v2ray-core/releases"; fi)" log Debug "正在下载 ${download_link}/download/${latest_version}/${download_file}" upfile "${box_dir}/${file_kernel}.zip" "${download_link}/download/${latest_version}/${download_file}" && xkernel "$core_to_update" "" "" "" "$file_kernel" ;; "hysteria") local arch case $(uname -m) in "aarch64") arch="arm64" ;; "armv7l" | "armv8l") arch="armv7" ;; "i686") arch="386" ;; "x86_64") arch="amd64" ;; *) log Warning "不支持的架构: $(uname -m)" return 1 ;; esac mkdir -p "${bin_dir}/backup" if [ -f "${bin_dir}/hysteria" ]; then cp "${bin_dir}/hysteria" "${bin_dir}/backup/hysteria.bak" >/dev/null 2>&1 fi local latest_version=$($rev1 "https://api.github.com/repos/apernet/hysteria/releases" | grep "tag_name" | grep -oE "[0-9.].*" | head -1 | sed 's/,//g' | cut -d '"' -f 1) if [ -z "$latest_version" ]; then log Error "获取 hysteria 最新版本号失败" return 1 fi local download_link="https://github.com/apernet/hysteria/releases/download/app%2Fv${latest_version}/hysteria-android-${arch}" log Debug "正在下载 ${download_link}" upfile "${bin_dir}/hysteria" "${download_link}" && xkernel "$core_to_update" ;; *) log Error "<${core_to_update}> 未知的二进制文件." return 1 ;; esac } upkernels() { for core in "$@"; do upkernel "$core" done } xkernel() { local core_to_process="$1" local platform="$2" local arch="$3" local latest_version="$4" local file_kernel="$5" local original_bin_name=$bin_name local target_bin_name="$core_to_process" if [ "$core_to_process" = "mihomo_smart" ]; then target_bin_name="mihomo" fi bin_name=$core_to_process case "${core_to_process}" in "mihomo"|"mihomo_smart") gunzip_command="gunzip" if ! command -v gunzip >/dev/null; then gunzip_command="busybox gunzip" fi if ${gunzip_command} -f "${box_dir}/${file_kernel}.gz" >&2 && mv "${box_dir}/${file_kernel}" "${bin_dir}/${target_bin_name}"; then log Info "${target_bin_name} 已成功更新 (来自: ${core_to_process})" else log Error "解压或移动 ${target_bin_name} 核心失败." bin_name=$original_bin_name return 1 fi ;; "sing-box") tar_command="tar" if ! command -v tar >/dev/null; then tar_command="busybox tar" fi log Info "正在解压 Sing-Box 核心..." if ${tar_command} -xf "${box_dir}/${file_kernel}.tar.gz" -C "${bin_dir}" >/dev/null; then mv "${bin_dir}/sing-box-${latest_version#v}-${platform}-${arch}/sing-box" "${bin_dir}/${core_to_process}" if [ -f "${box_pid}" ]; then rm -rf /data/adb/box/sing-box/cache.db restart_box "$core_to_process" else log Debug "${core_to_process} 无需重启." fi else log Error "解压 ${box_dir}/${file_kernel}.tar.gz 失败." fi [ -d "${bin_dir}/sing-box-${latest_version#v}-${platform}-${arch}" ] && \ rm -r "${bin_dir}/sing-box-${latest_version#v}-${platform}-${arch}" ;; "v2fly"|"xray") bin="xray" if [ "${core_to_process}" != "xray" ]; then bin="v2ray" fi unzip_command="unzip" if ! command -v unzip >/dev/null; then unzip_command="busybox unzip" fi mkdir -p "${bin_dir}/update" log Info "正在解压 ${bin} 核心..." if ${unzip_command} -oq "${box_dir}/${file_kernel}.zip" "${bin}" -d "${bin_dir}/update"; then if mv "${bin_dir}/update/${bin}" "${bin_dir}/${core_to_process}"; then true # 成功 else log Error "移动核心失败." rm -rf "${bin_dir}/update" return 1 fi else log Error "解压 ${box_dir}/${file_kernel}.zip 失败." rm -rf "${bin_dir}/update" return 1 fi rm -rf "${bin_dir}/update" ;; "hysteria") true ;; *) log Error "<${core_to_process}> 未知的二进制文件." bin_name=$original_bin_name return 1 ;; esac find "${box_dir}" -maxdepth 1 -type f -name "${file_kernel}.*" -delete chown ${box_user_group} "${bin_dir}/${target_bin_name}" chmod 0755 "${bin_dir}/${target_bin_name}" if [ -f "${box_pid}" ]; then if [ "$original_bin_name" = "$target_bin_name" ]; then log Info "检测到正在运行的核心已被更新，将自动重启服务..." restart_box "$target_bin_name" else log Info "${target_bin_name} 已更新，但当前运行的是 ${original_bin_name}，无需重启。" fi else log Info "服务未在运行，无需重启。" fi bin_name=$original_bin_name } upxui() { if [[ "${bin_name}" == @(mihomo|sing-box) ]]; then local ui_path local ui_url if [ "${bin_name}" = "mihomo" ]; then ui_path=$(busybox awk '!/^ *#/ && /^external-ui:/ {print $2; exit}' "${mihomo_config}" | sed "s/[\"']//g") ui_url=$(busybox awk '!/^ *#/ && /^external-ui-url:/ {print $2; exit}' "${mihomo_config}" 2>/dev/null | sed "s/[\"']//g") else ui_path=$(busybox awk -F '"' '/"external_ui"/ {print $4}' "${sing_config}" | head -n 1) ui_url=$(busybox awk -F '"' '/"external_ui_download_url"/ {print $4; exit}' "${sing_config}" 2>/dev/null) fi if [ -z "${ui_path}" ]; then ui_path="./dashboard" log Warning "配置文件中未找到 external-ui/external_ui 字段，使用默认路径: ${ui_path}" fi log Debug "配置文件中的 UI 路径: ${ui_path}" local dashboard_dir if [[ "${ui_path}" == ./* ]]; then dashboard_dir="${box_dir}/${bin_name}/${ui_path#./}" elif [[ "${ui_path}" == /* ]]; then dashboard_dir="${ui_path}" else dashboard_dir="${box_dir}/${bin_name}/${ui_path}" fi log Info "Dashboard 目标目录: ${dashboard_dir}" file_dashboard="${box_dir}/${bin_name}_dashboard.zip" if [ -n "${ui_url}" ]; then url="${ui_url}" else url="https://github.com/Zephyruso/zashboard/releases/latest/download/dist.zip" fi if upfile "${file_dashboard}" "${url}"; then if [ ! -d "${dashboard_dir}" ]; then log Info "面板文件夹不存在, 正在创建: ${dashboard_dir}" mkdir -p "${dashboard_dir}" else log Debug "清理现有面板文件: ${dashboard_dir}" rm -rf "${dashboard_dir}/"* fi if command -v unzip >/dev/null; then unzip_command="unzip" else unzip_command="busybox unzip" fi log Info "正在解压 Dashboard..." local temp_extract_dir="${box_dir}/${bin_name}_dashboard_temp" rm -rf "${temp_extract_dir}" mkdir -p "${temp_extract_dir}" if "${unzip_command}" -oq "${file_dashboard}" -d "${temp_extract_dir}"; then local html_path html_path=$(busybox find "${temp_extract_dir}" -maxdepth 3 -type f -name index.html | head -n 1) if [ -n "${html_path}" ]; then local html_dir html_dir="${html_path%/*}" mv -f "${html_dir}"/* "${dashboard_dir}/" else local top_dir top_dir=$(find "${temp_extract_dir}" -mindepth 1 -maxdepth 1 -type d | head -n 1) if [ -n "${top_dir}" ] && [ -z "$(find "${temp_extract_dir}" -mindepth 1 -maxdepth 1 -type d | sed -n '2p')" ]; then mv -f "${top_dir}"/* "${dashboard_dir}/" else mv -f "${temp_extract_dir}"/* "${dashboard_dir}/" fi fi else log Error "解压 Dashboard 失败" rm -f "${file_dashboard}" rm -rf "${temp_extract_dir}" return 1 fi if [ -z "$(find "${dashboard_dir}" -mindepth 1 -maxdepth 1 | head -n 1)" ]; then log Error "Dashboard 目录为空，更新失败" rm -f "${file_dashboard}" rm -rf "${temp_extract_dir}" return 1 fi rm -f "${file_dashboard}" rm -rf "${temp_extract_dir}" log Info "Dashboard 更新成功 → ${dashboard_dir}" else log Error "下载 Dashboard 失败" return 1 fi return 0 else log Debug "${bin_name} 不支持面板" return 1 fi } cgroup_blkio() { local pid_file="$1" local fallback_weight="${2:-900}" if [ -z "$pid_file" ] || [ ! -f "$pid_file" ]; then log Warning "PID 文件丢失或无效: $pid_file" return 1 fi local PID=$(<"$pid_file" 2>/dev/null) if [ -z "$PID" ] || ! kill -0 "$PID" >/dev/null 2>&1; then log Warning "来自 ${pid_file} 的 PID $PID 无效或未运行" return 1 fi if [ -z "$blkio_path" ]; then blkio_path=$(mount | grep cgroup | busybox awk '/blkio/{print $3}' | head -1) if [ -z "$blkio_path" ] || [ ! -d "$blkio_path" ]; then log Warning "blkio cgroup 路径未找到" return 1 fi fi local target="${blkio_path}/box" if [ ! -d "$target" ]; then mkdir -p "$target" 2>/dev/null if [ ! -d "$target" ]; then log Warning "无法创建 box blkio 目录: $target" if [ -d "${blkio_path}/foreground" ]; then target="${blkio_path}/foreground" log Info "回退使用现有 blkio 目录: foreground" elif [ -d "${blkio_path}/top-app" ]; then target="${blkio_path}/top-app" log Info "回退使用现有 blkio 目录: top-app" else log Warning "blkio 目标未找到，无法设置 IO 权重" return 1 fi else log Info "成功创建专用 box blkio 目录: $target" echo "$fallback_weight" > "${target}/blkio.weight" 2>/dev/null if [ $? -ne 0 ]; then log Warning "无法设置 blkio 权重到 ${target}/blkio.weight" else log Info "已设置 blkio 权重: $fallback_weight" fi fi fi echo "$PID" > "${target}/cgroup.procs" 2>/dev/null if [ $? -eq 0 ]; then log Info "已分配 PID $PID 到 ${target}，IO 权重 [$fallback_weight]" return 0 else log Warning "无法将 PID $PID 分配到 ${target}" return 1 fi } cgroup_memcg() { local pid_file="$1" local raw_limit="$2" if [ -z "$pid_file" ] || [ ! -f "$pid_file" ]; then log Warning "PID 文件丢失或无效: $pid_file" return 1 fi if [ -z "$raw_limit" ]; then log Warning "未指定 memcg 限制" return 1 fi local limit case "$raw_limit" in *[Mm]) limit=$(( ${raw_limit%[Mm]} * 1024 * 1024 )) ;; *[Gg]) limit=$(( ${raw_limit%[Gg]} * 1024 * 1024 * 1024 )) ;; *[Kk]) limit=$(( ${raw_limit%[Kk]} * 1024 )) ;; *[0-9]) limit=$raw_limit ;; *) log Warning "无效的 memcg 限制格式: $raw_limit" return 1 ;; esac local PID PID=$(<"$pid_file" 2>/dev/null) if [ -z "$PID" ] || ! kill -0 "$PID" >/dev/null 2>&1; then log Warning "来自 ${pid_file} 的 PID $PID 无效或未运行" return 1 fi if [ -z "$memcg_path" ]; then memcg_path=$(mount | grep cgroup | busybox awk '/memory/{print $3}' | head -1) if [ -z "$memcg_path" ] || [ ! -d "$memcg_path" ]; then log Warning "memory cgroup 路径未找到" return 1 fi fi local target="${memcg_path}/box" if [ ! -d "$target" ]; then mkdir -p "$target" 2>/dev/null if [ ! -d "$target" ]; then log Warning "无法创建 box memory 目录: $target" local name="${bin_name:-app}" target="${memcg_path}/${name}" mkdir -p "$target" 2>/dev/null if [ ! -d "$target" ]; then log Warning "无法创建 memory 目录: $target" return 1 fi log Info "回退使用 memory 目录: $target" else log Info "成功创建专用 box memory 目录: $target" fi fi local hr_limit="$limit B" if [ "$limit" -ge 1073741824 ]; then hr_limit="$(busybox awk -v b=$limit 'BEGIN{printf "%.2f GiB", b/1073741824}')" elif [ "$limit" -ge 1048576 ]; then hr_limit="$(busybox awk -v b=$limit 'BEGIN{printf "%.2f MiB", b/1048576}')" elif [ "$limit" -ge 1024 ]; then hr_limit="$(busybox awk -v b=$limit 'BEGIN{printf "%.2f KiB", b/1024}')" fi echo "$limit" > "${target}/memory.limit_in_bytes" 2>/dev/null if [ $? -ne 0 ]; then log Warning "无法设置内存限制到 ${target}/memory.limit_in_bytes" return 1 fi log Info "已设置内存限制: ${hr_limit} (${limit} 字节)" echo "$PID" > "${target}/cgroup.procs" 2>/dev/null if [ $? -eq 0 ]; then log Info "已分配 PID $PID 到 ${target}，内存限制 [$hr_limit]" return 0 else log Warning "无法将 PID $PID 分配到 ${target}" return 1 fi } cgroup_cpuset() { local pid_file="${1}" local cores="${2}" if [ -z "${pid_file}" ] || [ ! -f "${pid_file}" ]; then log Warning "PID 文件丢失或无效: ${pid_file}" return 1 fi local PID PID=$(<"${pid_file}" 2>/dev/null) if [ -z "$PID" ] || ! kill -0 "$PID" >/dev/null; then log Warning "来自 ${pid_file} 的 PID $PID 无效或未运行" return 1 fi if [ -z "${cores}" ]; then local total_core total_core=$(nproc --all 2>/dev/null) if [ -z "$total_core" ] || [ "$total_core" -le 0 ]; then log Warning "检测 CPU 核心失败" return 1 fi cores="0-$((total_core - 1))" fi if [ -z "${cpuset_path}" ]; then cpuset_path=$(mount | grep cgroup | busybox awk '/cpuset/{print $3}' | head -1) if [ -z "${cpuset_path}" ] || [ ! -d "${cpuset_path}" ]; then log Warning "cpuset_path 未找到" return 1 fi fi local cpuset_target="${cpuset_path}/box" if [ ! -d "${cpuset_target}" ]; then mkdir -p "${cpuset_target}" 2>/dev/null if [ ! -d "${cpuset_target}" ]; then log Warning "无法创建 box cpuset 目录: ${cpuset_target}" cpuset_target="${cpuset_path}/foreground" if [ ! -d "${cpuset_target}" ]; then cpuset_target="${cpuset_path}/top-app" fi if [ ! -d "${cpuset_target}" ]; then cpuset_target="${cpuset_path}/apps" if [ ! -d "${cpuset_target}" ]; then log Warning "cpuset 目标未找到，无法设置 CPU 核心" return 1 fi fi log Info "回退使用现有 cpuset 目录: ${cpuset_target}" else log Info "成功创建专用 box cpuset 目录: ${cpuset_target}" if [ -f "${cpuset_path}/cpus" ]; then cat "${cpuset_path}/cpus" > "${cpuset_target}/cpus" 2>/dev/null fi if [ -f "${cpuset_path}/mems" ]; then cat "${cpuset_path}/mems" > "${cpuset_target}/mems" 2>/dev/null fi fi fi echo "${cores}" > "${cpuset_target}/cpus" 2>/dev/null if [ $? -ne 0 ]; then log Warning "无法设置 CPU 核心到 ${cpuset_target}/cpus" return 1 fi echo "0" > "${cpuset_target}/mems" 2>/dev/null if [ $? -ne 0 ]; then log Warning "无法设置内存节点到 ${cpuset_target}/mems" return 1 fi echo "${PID}" > "${cpuset_target}/cgroup.procs" 2>/dev/null if [ $? -eq 0 ]; then log Info "已分配 PID $PID 到 ${cpuset_target}，CPU 核心 [$cores]" return 0 else log Warning "无法将 PID $PID 分配到 ${cpuset_target}" return 1 fi } webroot() { ip_port=$(if [ "${bin_name}" = "mihomo" ]; then busybox awk '/external-controller:/ {print $2}' "${mihomo_config}"; else busybox awk -F'[:,]' '/"external_controller"/ {print $2":"$3}' "${sing_config}" | sed 's/^[ \t]*//;s/"//g'; fi;) secret=$(if [ "${bin_name}" = "mihomo" ]; then busybox awk '/^secret:/ {print $2}' "${mihomo_config}" | sed 's/"//g'; else busybox awk -F'"' '/"secret"/ {print $4}' "${sing_config}" | head -n 1; fi;) path_webroot="/data/adb/modules/box_for_root/webroot/index.html" touch "$path_webroot" if [[ "${bin_name}" = @(mihomo|sing-box) ]]; then echo -e ' ' > $path_webroot sed -i "s#document\.location =.*#document.location = 'http://$ip_port/ui/'#" $path_webroot else echo -e ' 不支持WebUI

不支持WebUI

抱歉，xray/v2ray 不支持所需的WebUI功能。

' > $path_webroot fi log Info "已生成/更新 WebUI 页面: ${path_webroot} → http://${ip_port}/ui/ (内核: ${bin_name})" } bond0() { sysctl -w net.ipv4.tcp_low_latency=0 >/dev/null 2>&1 log Debug "tcp 低延迟: 0" for dev in /sys/class/net/wlan*; do ip link set dev $(basename $dev) txqueuelen 3000; done log Debug "wlan* 传输队列长度: 3000" for txqueuelen in /sys/class/net/rmnet_data*; do txqueuelen_name=$(basename $txqueuelen); ip link set dev $txqueuelen_name txqueuelen 1000; done log Debug "rmnet_data* 传输队列长度: 1000" for mtu in /sys/class/net/rmnet_data*; do mtu_name=$(basename $mtu); ip link set dev $mtu_name mtu 1500; done log Debug "rmnet_data* MTU: 1500" } bond1() { sysctl -w net.ipv4.tcp_low_latency=1 >/dev/null 2>&1 log Debug "tcp 低延迟: 1" for dev in /sys/class/net/wlan*; do ip link set dev $(basename $dev) txqueuelen 4000; done log Debug "wlan* 传输队列长度: 4000" for txqueuelen in /sys/class/net/rmnet_data*; do txqueuelen_name=$(basename $txqueuelen); ip link set dev $txqueuelen_name txqueuelen 2000; done log Debug "rmnet_data* 传输队列长度: 2000" for mtu in /sys/class/net/rmnet_data*; do mtu_name=$(basename $mtu); ip link set dev $mtu_name mtu 9000; done log Debug "rmnet_data* MTU: 9000" } case "$1" in check) check ;; memcg|cpuset|blkio) case "$1" in memcg) memcg_path="" cgroup_memcg "${box_pid}" ${memcg_limit} ;; cpuset) cpuset_path="" cgroup_cpuset "${box_pid}" ${allow_cpu} ;; blkio) blkio_path="" cgroup_blkio "${box_pid}" "${weight}" ;; esac ;; bond0|bond1) $1 ;; geosub) upsubs || exit 1 upgeox if [ -f "${box_pid}" ]; then kill -0 "$(<"${box_pid}" 2>/dev/null)" && reload fi ;; geox|subs) if [ "$1" = "geox" ]; then upgeox else upsubs || exit 1 fi if [ -f "${box_pid}" ]; then kill -0 "$(<"${box_pid}" 2>/dev/null)" && reload fi ;; upkernel) upkernel "$2" ;; upkernels) shift upkernels "$@" ;; upgeox_all) upgeox_all ;; upxui) upxui ;; upcnip) upcnip ;; upyq|upcurl) $1 ;; reload) reload ;; webroot) webroot ;; all) upyq upcurl upgeox_all upkernels sing-box mihomo xray v2fly hysteria for bin_name in "${bin_list[@]}"; do upsubs upxui done ;; *) log Error "$0 $1 未找到" log Info "用法: $0 {check|memcg|cpuset|blkio|geosub|geox|subs|upkernel [name]|upkernels [name...]|upgeox_all|upxui|upyq|upcurl|upcnip|reload|webroot|bond0|bond1|all}" log Info "upkernel 支持的核心: sing-box, mihomo, mihomo_smart, xray, v2fly, hysteria" ;; esac box-debug/box/scripts/ctr.inotify000066400000000000000000000056671516412072700174270ustar00rootroot00000000000000#!/system/bin/sh export PATH="/data/adb/magisk:/data/adb/ksu/bin:/data/adb/ap/bin:$PATH:/data/data/com.termux/files/usr/bin" BASE_DIR="/data/adb/box" LOG_DIR="${BASE_DIR}/run" SCRIPTS_DIR="$(dirname "$(realpath "$0")")" LOG_FILE="${LOG_DIR}/netswitch.log" STATE_FILE="${BASE_DIR}/run/state/last_check_time" WIFI_STATE_FILE="${BASE_DIR}/run/state/last_wifi_state" STABILITY_WINDOW=3 [ "$1" != "w" ] && exit 0 source "${BASE_DIR}/settings.ini" [ "$enable_network_service_control" != "true" ] && exit 0 source "${SCRIPTS_DIR}/ctr.utils" mkdir -p "$RUN_DIR" mkdir -p "${LOG_DIR}" "${BASE_DIR}/run/state" >/dev/null 2>&1 || true log_msg() { [ "$inotify_log_enabled" = "true" ] || return 0 echo "$(date '+%Y-%m-%d %H:%M:%S') - $*" >> "$LOG_FILE" } clean_old_logs() { [ -f "$LOG_FILE" ] || return 0 local cutoff=$(date -d '24 hours ago' '+%Y-%m-%d %H:%M:%S' 2>/dev/null) [ -n "$cutoff" ] || return 0 busybox awk -v c="$cutoff" '!/^[0-9]{4}-/ || substr($0,1,19)>=c' "$LOG_FILE" > "${LOG_FILE}.tmp" && mv "${LOG_FILE}.tmp" "$LOG_FILE" } check_stability_window() { local current=$(date +%s) local last=0 [ -f "$STATE_FILE" ] && last=$(cat "$STATE_FILE" 2>/dev/null || echo 0) if [ $((current - last)) -lt $STABILITY_WINDOW ]; then log_msg "跳过: 稳定窗口内 ($((current - last))秒)" exit 0 fi echo "$current" > "$STATE_FILE" } is_service_running() { [ -f "$box_pid" ] && kill -0 $(cat "$box_pid" 2>/dev/null) 2>/dev/null } start_service() { if is_service_running; then log_msg "[跳过] 服务已在运行" return 0 fi "${SCRIPTS_DIR}/box.service" start "${SCRIPTS_DIR}/box.iptables" enable log_msg "[启动] 服务已启动" } stop_service() { if ! is_service_running; then log_msg "[跳过] 服务已停止" return 0 fi "${SCRIPTS_DIR}/box.iptables" disable "${SCRIPTS_DIR}/box.service" stop log_msg "[停止] 服务已停止" } save_wifi_state() { local ssid="$1" local bssid="$2" local ip="$3" cat > "$WIFI_STATE_FILE" <<-EOF ssid:${ssid} bssid:${bssid} ip:${ip} EOF } main() { clean_old_logs check_stability_window local wifi_status=$(is_wifi_connected) local ssid=$(get_current_ssid) local bssid=$(get_current_bssid) local wifi_ip log_msg "--- 网络状态检查 ---" if [ "$wifi_status" = "wifi" ]; then # 等待 IP 地址 for i in 1 2 3; do wifi_ip=$(get_wifi_ip) [ -n "$wifi_ip" ] && break sleep 1 done if [ -z "$wifi_ip" ]; then log_msg "WiFi 连接中，等待 IP 地址" exit 0 fi log_msg "WiFi: ${ssid}, BSSID: ${bssid}, IP: ${wifi_ip}" save_wifi_state "$ssid" "$bssid" "$wifi_ip" else log_msg "WiFi: 已断开" fi # 判断是否应该启用服务 if should_enable_service "$wifi_status" "$ssid" "$bssid"; then log_msg "策略: 启用服务" start_service else log_msg "策略: 禁用服务" stop_service fi log_msg "完成" } mainbox-debug/box/scripts/ctr.utils000066400000000000000000000063441516412072700170770ustar00rootroot00000000000000#!/system/bin/sh # shellcheck disable=SC2039 get_wifi_iface() { local iface iface=$(ip route 2>/dev/null | busybox awk '$1=="default" {print $5; exit}') if [ -n "$iface" ] && ip link show "$iface" >/dev/null 2>&1; then echo "$iface" return 0 fi iface=$(ip link 2>/dev/null | busybox awk -F': ' '/: (wlan|swlan)[0-9]+/ {print $2; exit}') if [ -n "$iface" ] && ip link show "$iface" >/dev/null 2>&1; then echo "$iface" return 0 fi echo "wlan0" } # 获取当前 WiFi SSID get_current_ssid() { local ssid local iface iface=$(get_wifi_iface) ssid=$(cmd wifi status 2>/dev/null | sed -n 's/.*SSID: "\([^"]*\)".*/\1/p' | head -n1) if [ -z "$ssid" ] || [ "$ssid" = "" ]; then ssid=$(iwconfig "$iface" 2>/dev/null | busybox awk -F'ESSID:' '{print $2}' | tr -d '"' | busybox awk '{print $1}') fi if [ -z "$ssid" ] || [ "$ssid" = "off/any" ]; then echo "unknown" else echo "$ssid" fi } # 获取当前 WiFi BSSID get_current_bssid() { local bssid local iface iface=$(get_wifi_iface) bssid=$(cmd wifi status 2>/dev/null | sed -n 's/.*BSSID: \([0-9a-fA-F:][0-9a-fA-F:]*\).*/\1/p' | head -n1) if [ -z "$bssid" ] || [ "$bssid" = "" ]; then bssid=$(iw dev "$iface" link 2>/dev/null | sed -n 's/^Connected to \([0-9a-fA-F:][0-9a-fA-F:]*\).*/\1/p' | head -n1) fi if [ -z "$bssid" ] || [ "$bssid" = "Not-Associated" ]; then bssid=$(iwconfig "$iface" 2>/dev/null | sed -n 's/.*Access Point: \([0-9A-Fa-f:][0-9A-Fa-f:]*\).*/\1/p' | head -n1) fi if [ -z "$bssid" ] || [ "$bssid" = "00:00:00:00:00:00" ]; then echo "unknown" else echo "$bssid" fi } # 检查 WiFi 是否连接 is_wifi_connected() { local iface iface=$(get_wifi_iface) if ip addr show "$iface" 2>/dev/null | grep -Eq 'inet6? '; then echo "wifi" return 0 fi echo "not_wifi" } # 获取 WiFi IP 地址 get_wifi_ip() { local iface iface=$(get_wifi_iface) ip addr show "$iface" 2>/dev/null | busybox awk '/inet /{print $2}' | cut -d/ -f1 | head -n1 } # 检查 SSID 是否在列表中 is_ssid_in_list() { local ssid="$1" local item for item in "${wifi_ssids_list[@]}"; do [ "$ssid" = "$item" ] && return 0 done return 1 } # 检查 BSSID 是否在列表中 is_bssid_in_list() { local bssid="$1" local item for item in "${wifi_bssids_list[@]}"; do [ "$bssid" = "$item" ] && return 0 done return 1 } # 判断是否应该启用服务 should_enable_service() { local wifi_status="$1" local ssid="$2" local bssid="$3" local matched="false" if [ "$wifi_status" = "not_wifi" ]; then [ "$use_module_on_wifi_disconnect" = "true" ] && return 0 || return 1 fi if [ "$use_module_on_wifi" = "false" ]; then return 1 fi if [ "$use_ssid_matching" = "true" ]; then if [ -n "${wifi_bssids_list[*]}" ] && [ "$bssid" != "unknown" ]; then is_bssid_in_list "$bssid" && matched="true" || matched="false" else [ -n "${wifi_ssids_list[*]}" ] && is_ssid_in_list "$ssid" && matched="true" || matched="false" fi if [ "$matched" = "true" ]; then [ "$use_wifi_list_mode" = "whitelist" ] && return 0 || return 1 else [ "$use_wifi_list_mode" = "whitelist" ] && return 1 || return 0 fi fi return 0 }box-debug/box/scripts/net.inotify000066400000000000000000000064441516412072700174170ustar00rootroot00000000000000#!/system/bin/sh # 检查模块是否已禁用 if [ -f "/data/adb/modules/box_for_root/disable" ]; then exit 0 fi events=$1 # monitor_dir=$2 # monitor_file=$3 export PATH="/data/adb/magisk:/data/adb/ksu/bin:/data/adb/ap/bin:$PATH:/system/bin" # ex: 7.1.1 buildVersion=$(getprop ro.build.version.release) minBuildVersion="11" IPV="iptables" # Default IP6V="ip6tables" # Default # ex: 7.1.1 -> 7 buildVersionMajor=${buildVersion%%.*} if [ "$buildVersionMajor" -ge "$minBuildVersion" ]; then IPV="iptables -w 100" IP6V="ip6tables -w 100" fi iptables="${IPV}" ip6tables="${IP6V}" logs="/data/adb/box/run" log_file="${logs}/net.log" lock_dir="${logs}/locks/net_inotify.lock" log_info() { mkdir -p "${logs}" >/dev/null 2>&1 || true echo "[$(date '+%F %T')] [Info]: $*" >> "${log_file}" 2>&1 } log_warn() { mkdir -p "${logs}" >/dev/null 2>&1 || true echo "[$(date '+%F %T')] [Warn]: $*" >> "${log_file}" 2>&1 } log_reset() { mkdir -p "${logs}" >/dev/null 2>&1 || true : > "${log_file}" 2>&1 || true } with_lock_or_skip() { mkdir -p "${logs}" "${logs}/locks" >/dev/null 2>&1 || true if ! mkdir "${lock_dir}" >/dev/null 2>&1; then return 1 fi trap "rmdir \"${lock_dir}\" >/dev/null 2>&1 || true" EXIT INT TERM return 0 } chain_exists() { local ipt_cmd="$1" local table_name="$2" local chain_name="$3" ${ipt_cmd} -t "${table_name}" -L "${chain_name}" >/dev/null 2>&1 } ensure_chain_and_flush() { local ipt_cmd="$1" local table_name="$2" local chain_name="$3" ${ipt_cmd} -t "${table_name}" -N "${chain_name}" >/dev/null 2>&1 || true ${ipt_cmd} -t "${table_name}" -F "${chain_name}" >/dev/null 2>&1 || true } ensure_rule_append() { local ipt_cmd="$1" local table_name="$2" local chain_name="$3" shift 3 if ${ipt_cmd} -t "${table_name}" -C "${chain_name}" "$@" >/dev/null 2>&1; then return 0 fi ${ipt_cmd} -t "${table_name}" -A "${chain_name}" "$@" >/dev/null 2>&1 } rules_add() { mkdir -p "${logs}" >/dev/null 2>&1 || true ensure_chain_and_flush "${iptables}" mangle LOCAL_IP_V4 ensure_chain_and_flush "${iptables}" nat LOCAL_IP_V4 ip -4 a | busybox awk '/inet/ {print $2}' | busybox sort -u | busybox grep -vE "^127\\.0\\.0\\.1" | while read -r local_ipv4 ; do rv1=1 rv2=1 ensure_rule_append "${iptables}" mangle LOCAL_IP_V4 -d "${local_ipv4}" -j ACCEPT rv1=$? ensure_rule_append "${iptables}" nat LOCAL_IP_V4 -d "${local_ipv4}" -j ACCEPT rv2=$? if [ "${rv1}" = "0" ] || [ "${rv2}" = "0" ]; then log_info "本地IP ${local_ipv4}，防环回规则已更新" else log_warn "本地IP ${local_ipv4}，防环回规则更新失败" fi done ensure_chain_and_flush "${ip6tables}" mangle LOCAL_IP_V6 ip -6 a | busybox awk '/inet6/ {print $2}' | busybox sort -u | busybox grep -vE "^fe80|^::1|^fd00" | while read -r local_ipv6 ; do rv6=1 ensure_rule_append "${ip6tables}" mangle LOCAL_IP_V6 -d "${local_ipv6}" -j ACCEPT rv6=$? if [ "${rv6}" = "0" ]; then log_info "本地IP ${local_ipv6}，防环回规则已更新" else log_warn "本地IP ${local_ipv6}，防环回规则更新失败" fi done } if [ "$events" = "w" ]; then # 只有 box.pid 存在时才执行原有规则 if [ -f "/data/adb/box/run/box.pid" ]; then if with_lock_or_skip; then log_reset rules_add fi fi fi box-debug/box/scripts/start.sh000077500000000000000000000047101516412072700167140ustar00rootroot00000000000000#!/system/bin/sh scripts_dir="${0%/*}" file_settings="/data/adb/box/settings.ini" moddir="/data/adb/modules/box_for_root" if [ -f "$file_settings" ]; then . "$file_settings" fi # busybox Magisk/KSU/Apatch busybox="/data/adb/magisk/busybox" [ -f "/data/adb/ksu/bin/busybox" ] && busybox="/data/adb/ksu/bin/busybox" [ -f "/data/adb/ap/bin/busybox" ] && busybox="/data/adb/ap/bin/busybox" wait_for_data_ready() { while [ ! -f "/data/system/packages.xml" ] ; do sleep 1 done } refresh_box() { if [ -f "/data/adb/box/run/box.pid" ]; then "${scripts_dir}/box.service" stop > "/dev/null" 2>&1 "${scripts_dir}/box.iptables" disable > "/dev/null" 2>&1 fi } start_service() { if [ -f "$file_settings" ]; then . "$file_settings" fi if [ "$boot_auto_start" = "false" ]; then echo "开机自启已禁用，跳过启动核心服务。" return 0 fi if [ ! -f "${moddir}/disable" ]; then "${scripts_dir}/box.service" start > "/dev/null" 2>&1 fi } enable_iptables() { PIDS=("mihomo" "xray" "sing-box" "v2fly") PID="" i=0 while [ -z "$PID" ] && [ "$i" -lt "${#PIDS[@]}" ]; do PID=$($busybox pidof "${PIDS[$i]}") i=$((i+1)) done if [ -n "$PID" ]; then "${scripts_dir}/box.iptables" enable > "/dev/null" 2>&1 fi } net_inotifyd() { while [ ! -f /data/misc/net/rt_tables ] ; do sleep 1 done net_dir="/data/misc/net" # Use inotifyd to monitor write events in the /data/misc/net directory for network changes, perhaps we have a better choice of files to monitor (the /proc filesystem is unsupported) and cyclic polling is a bad solution inotifyd "${scripts_dir}/net.inotify" "${net_dir}" > "/dev/null" 2>&1 & } start_inotifyd() { PIDs=($($busybox pidof inotifyd)) for PID in "${PIDs[@]}"; do if grep -q -e "box.inotify" -e "net.inotify" "/proc/$PID/cmdline"; then kill -9 "$PID" fi # if grep -q "box.inotify" "/proc/$PID/cmdline"; then # kill -9 "$PID" # fi done inotifyd "${scripts_dir}/box.inotify" "${moddir}" > "/dev/null" 2>&1 & net_inotifyd } mkdir -p /data/adb/box/run/ /data/adb/box/run/state/ /data/adb/box/run/locks/ >/dev/null 2>&1 || true if [ -f "/data/adb/box/manual" ]; then if [ -f "/data/adb/box/run/box.pid" ]; then rm /data/adb/box/run/box.pid fi net_inotifyd exit 1 fi if [ -f "$file_settings" ] && [ -r "$file_settings" ] && [ -s "$file_settings" ]; then wait_for_data_ready refresh_box start_service enable_iptables fi start_inotifyd box-debug/box/settings.ini000077500000000000000000000163311516412072700160770ustar00rootroot00000000000000#!/system/bin/sh # ════════════════════ # Box for Root - 配置文件 # ════════════════════ # 系统初始化：检查 busybox 并设置环境变量 if ! command -v busybox &> /dev/null; then export PATH="/data/adb/magisk:/data/adb/ksu/bin:/data/adb/ap/bin:$PATH:/system/bin" fi # ════════════════════ # 核心路径配置 (请勿修改) # ════════════════════ box_dir="/data/adb/box" box_run="${box_dir}/run" box_run_state="${box_run}/state" box_run_locks="${box_run}/locks" mkdir -p "${box_run_state}" "${box_run_locks}" >/dev/null 2>&1 || true box_log="${box_run}/runs.log" box_pid="${box_run}/box.pid" bin_dir="${box_dir}/bin" system_packages_file="/data/system/packages.list" uid_list="${box_run_state}/appuid.list" # ════════════════════ # 基础设置 # ════════════════════ # 开机自启 boot_auto_start="true" current_time=$(date +"%H:%M") box_user_group="root:net_admin" # ════════════════════ # 代理核心配置 # ════════════════════ bin_name="mihomo" bin_list=("mihomo" "sing-box" "xray" "v2fly" "hysteria") bin_path="${bin_dir}/${bin_name}" bin_log="${box_run}/${bin_name}.log" # 启动时自动修改核心配置文件 auto_modify_config="true" # ════════════════════ # 网络配置 # ════════════════════ # 网络模式: tun / tproxy / redirect / mixed / enhance network_mode="tun" tproxy_port="9898" redir_port="9797" ipv6="true" quic="enable" mihomo_dns_forward="enable" proxy_tcp="true" proxy_udp="true" dns_hijack_tcp="true" dns_hijack_udp="true" # DNS 劫持策略: disable / tproxy/ redirect dns_hijack_mode="tproxy" # 绕过大陆 IP（需要设备支持 ipset） bypass_cn_ip="false" bypass_cn_ip_v4="false" bypass_cn_ip_v6="false" cn_ip_file="${box_run_state}/cn_ip.txt" cn_ipv6_file="${box_run_state}/cn_ipv6.txt" cn_ip_url="https://ispip.clang.cn/all_cn.txt" cn_ipv6_url="https://ispip.clang.cn/all_cn_ipv6.txt" # 热点场景 MAC 黑白名单（仅对热点/入站接口生效，默认关闭） mac_filter="false" mac_mode="blacklist" macs_list=() # ════════════════════ # 代理模式配置 # ════════════════════ # 代理模式: blacklist (黑名单) / whitelist (白名单) / core (核心模式) proxy_mode="core" # ════════════════════ # 订阅管理 # ════════════════════ # Mihomo 订阅链接数组 subscription_url_mihomo=() # Mihomo 订阅配置文件名数组 name_provide_mihomo_config=() # Mihomo 订阅文件存放目录 mihomo_provide_path="${box_dir}/mihomo/proxy_provider" # 是否支持订阅中的自定义规则 custom_rules_subs="false" name_provide_mihomo_rules="rules.yaml" mihomo_provide_rules="${box_dir}/mihomo/provide/${name_provide_mihomo_rules}" # Sing-box 订阅链接 subscription_url_singbox="" # ════════════════════ # 网络状态控制 # ════════════════════ # 是否根据网络状态自动控制服务（总开关） enable_network_service_control="false" # WiFi 连接时是否启用模块 use_module_on_wifi="true" # WiFi 断开时是否启用模块 use_module_on_wifi_disconnect="true" # 是否启用 WiFi 匹配（SSID/BSSID） use_ssid_matching="false" # SSID 匹配模式: blacklist (黑名单) / whitelist (白名单) use_wifi_list_mode="blacklist" # WiFi SSID 列表 wifi_ssids_list=("WiFi1" "WiFi2") # WiFi BSSID 列表 wifi_bssids_list=() # 是否启用网络切换调试日志 inotify_log_enabled="true" # ════════════════════ # 性能优化 # ════════════════════ # 内存限制 cgroup_memcg="false" memcg_limit="100M" # CPU 核心分配 cgroup_cpuset="false" allow_cpu="0-7" # 磁盘 I/O 权重 cgroup_blkio="false" weight="" # ════════════════════ # 核心配置文件路径 # ════════════════════ # Mihomo 配置文件 name_mihomo_config="config.yaml" mihomo_config="${box_dir}/mihomo/${name_mihomo_config}" # Sing-box 配置文件 name_sing_config="config.json" sing_config="${box_dir}/sing-box/${name_sing_config}" # Xray 配置文件 name_xray_config="config.json" xray_config="${box_dir}/xray/${name_xray_config}" # V2fly 配置文件 name_v2fly_config="config.json" v2fly_config="${box_dir}/v2fly/${name_v2fly_config}" # Hysteria 配置文件 name_hysteria_config="config.yaml" hysteria_config="${box_dir}/hysteria/${name_hysteria_config}" # ════════════════════ # 自动更新配置 # ════════════════════ # true: 覆盖配置文件, false: 只更新订阅 renew="false" # 是否启用订阅自动更新 update_subscription="false" # 是否启用 GeoX 数据自动更新 update_geo="false" # 是否启用定时任务 run_crontab="false" # 定时任务时间 interva_update="0 0,6,12,18 * * *" # ════════════════════ # 下载设置 # ════════════════════ # GitHub 访问令牌 githubtoken="" # 是否使用镜像加速 GitHub 下载 use_ghproxy="false" # 镜像加速地址 url_ghproxy="https://ghfast.top" # 核心版本: enable (稳定版) / disable (预发行版) mihomo_stable="enable" singbox_stable="enable" # ════════════════════ # 代理规则配置（请勿修改） # ════════════════════ write_listap="${box_dir}/ap.list.cfg" pkg_config="${box_dir}/package.list.cfg" gid_config="${box_dir}/gid.list.cfg" [ ! -f "${write_listap}" ] && touch "${write_listap}" [ ! -f "${pkg_config}" ] && touch "${pkg_config}" [ ! -f "${gid_config}" ] && touch "${gid_config}" prefixed_list=($(sed -n '/^[0-9][0-9]*:/p' "${pkg_config}")) unprefixed_list_converted=($(sed -n '/\./p' "${pkg_config}" | grep -v -E '^[0-9]+:|^[0-9]+$|^[[:space:]]*#' | sed 's/^/0:/')) packages_list=("${prefixed_list[@]}" "${unprefixed_list_converted[@]}") gid_list=($(busybox awk '!/^#/ && /^[0-9]+$/ {print $1}' "${gid_config}")) ap_list=($(busybox awk '/^allow / {print $2}' "${write_listap}")) ignore_ap_list=($(busybox awk '/^ignore / {print $2}' "${write_listap}")) # ════════════════════ # 日志系统（请勿修改） # ════════════════════ log() { local normal="\033[0m" local red="\033[1;31m" local green="\033[1;32m" local yellow="\033[1;33m" local blue="\033[1;34m" local color case $1 in Info) color="${blue}" ;; Error) color="${red}" ;; Warning) color="${yellow}" ;; *) color="${green}" ;; esac local message="${current_time} [$1]: $2" if [ -t 1 ]; then echo -e "${color}${message}${normal}" else echo "${message}" | tee -a "${box_log}" fi if [[ $TOAST ]]; then true fi } box-debug/box/sing-box/000077500000000000000000000000001516412072700152555ustar00rootroot00000000000000box-debug/box/sing-box/config.json000077500000000000000000000030351516412072700174210ustar00rootroot00000000000000{ "dns": { "servers": [ { "tag": "google", "type": "tls", "server": "8.8.8.8" }, { "tag": "local", "type": "https", "server": "223.5.5.5" } ], "rules": [ { "rule_set": "geosite-geolocation-cn", "server": "local" }, { "type": "logical", "mode": "and", "rules": [ { "rule_set": "geosite-geolocation-!cn", "invert": true }, { "rule_set": "geoip-cn" } ], "server": "local" } ] }, "route": { "default_domain_resolver": "local", "rule_set": [ { "type": "remote", "tag": "geosite-geolocation-cn", "format": "binary", "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-cn.srs" }, { "type": "remote", "tag": "geosite-geolocation-!cn", "format": "binary", "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-!cn.srs" }, { "type": "remote", "tag": "geoip-cn", "format": "binary", "url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs" } ] }, "experimental": { "cache_file": { "enabled": true, "store_rdrc": true }, "clash_api": { "default_mode": "Enhanced" } } }box-debug/box_service.sh000077500000000000000000000010351516412072700156050ustar00rootroot00000000000000#!/system/bin/sh ( until [ $(getprop init.svc.bootanim) = "stopped" ]; do sleep 10 done if [ -f "/data/adb/box/scripts/start.sh" ]; then chmod 755 /data/adb/box/scripts/* /data/adb/box/scripts/start.sh SCRIPTS_DIR="/data/adb/box/scripts" while [ ! -f /data/misc/net/rt_tables ]; do sleep 3 done inotifyd ${SCRIPTS_DIR}/ctr.inotify /data/misc/net/rt_tables > /dev/null 2>&1 & else echo "未找到文件 '/data/adb/box/scripts/start.sh'" fi )& box-debug/build.sh000077500000000000000000000004251516412072700143760ustar00rootroot00000000000000#!/bin/sh # 构建脚本：自动打包 Box 模块为 zip 文件 VERSION=$(cat module.prop | grep 'version=' | awk -F '=' '{print $2}' | tr -d '\r') zip -r -o -X -ll box-${VERSION}.zip ./ -x '.git/*' -x 'CHANGELOG.md' -x 'update.json' -x 'build.sh' -x '.github/*' -x 'LICENSE'box-debug/customize.sh000066400000000000000000000312431516412072700153200ustar00rootroot00000000000000 #!/system/bin/sh SKIPUNZIP=1 SKIPMOUNT=false PROPFILE=true POSTFSDATA=false LATESTARTSERVICE=true if [ "$BOOTMODE" != true ]; then abort "-----------------------------------------------------------" ui_print "! 请在 Magisk/KernelSU/APatch Manager 中安装本模块" ui_print "! 不支持从 Recovery 安装" abort "-----------------------------------------------------------" elif [ "$KSU" = true ] && [ "$KSU_VER_CODE" -lt 10670 ]; then abort "-----------------------------------------------------------" ui_print "! 请升级您的 KernelSU 及其管理器" abort "-----------------------------------------------------------" fi service_dir="/data/adb/service.d" if [ "$KSU" = "true" ]; then ui_print "- 检测到 KernelSU 版本: $KSU_VER ($KSU_VER_CODE)" [ "$KSU_VER_CODE" -lt 10683 ] && service_dir="/data/adb/ksu/service.d" elif [ "$APATCH" = "true" ]; then APATCH_VER=$(cat "/data/adb/ap/version") ui_print "- 检测到 APatch 版本: $APATCH_VER" else ui_print "- 检测到 Magisk 版本: $MAGISK_VER ($MAGISK_VER_CODE)" fi mkdir -p "${service_dir}" if [ -d "/data/adb/modules/box_for_magisk" ]; then rm -rf "/data/adb/modules/box_for_magisk" ui_print "- 已删除旧模块。" fi ui_print "- 正在安装 Box for Magisk/KernelSU/APatch" unzip -o "$ZIPFILE" -x 'META-INF/*' -x 'webroot/*' -d "$MODPATH" >&2 if [ -d "/data/adb/box" ]; then ui_print "- 备份现有 box 数据" temp_bak=$(mktemp -d -p "/data/adb/box" box.XXXXXXXXXX) temp_dir="${temp_bak}" mv /data/adb/box/* "${temp_dir}/" mv "$MODPATH/box/"* /data/adb/box/ backup_box="true" else mv "$MODPATH/box" /data/adb/ fi ui_print "- 创建目录" mkdir -p /data/adb/box/ /data/adb/box/run/ /data/adb/box/bin/ ui_print "- 提取 uninstall.sh 和 box_service.sh" unzip -j -o "$ZIPFILE" 'uninstall.sh' -d "$MODPATH" >&2 unzip -j -o "$ZIPFILE" 'box_service.sh' -d "${service_dir}" >&2 ui_print "- 设置权限" set_perm_recursive $MODPATH 0 0 0755 0644 set_perm_recursive /data/adb/box/ 0 3005 0755 0644 set_perm_recursive /data/adb/box/scripts/ 0 3005 0755 0700 set_perm ${service_dir}/box_service.sh 0 0 0755 set_perm $MODPATH/uninstall.sh 0 0 0755 chmod ugo+x ${service_dir}/box_service.sh $MODPATH/uninstall.sh /data/adb/box/scripts/* KEY_LISTENER_PID="" KEY_FIFO="" start_key_listener() { if [ -n "$KEY_LISTENER_PID" ] && kill -0 "$KEY_LISTENER_PID" 2>/dev/null; then return fi KEY_FIFO=$(mktemp -u -p /dev/tmp) mkfifo "$KEY_FIFO" || exit 1 getevent -ql > "$KEY_FIFO" & KEY_LISTENER_PID=$! } stop_key_listener() { if [ -n "$KEY_LISTENER_PID" ]; then kill "$KEY_LISTENER_PID" >/dev/null 2>&1 KEY_LISTENER_PID="" fi if [ -n "$KEY_FIFO" ]; then rm -f "$KEY_FIFO" KEY_FIFO="" fi } volume_key_detection() { local timeout_seconds="${1:-0}" local detection_result_file=$(mktemp -u -p /dev/tmp) ( while read -r line; do if echo "$line" | grep -Eiq "(KEY_)?VOLUME ?UP|KEYCODE_VOLUME_UP" && echo "$line" | grep -Eiq "DOWN|PRESS"; then echo "0" > "$detection_result_file" exit 0 elif echo "$line" | grep -Eiq "(KEY_)?VOLUME ?DOWN|KEYCODE_VOLUME_DOWN" && echo "$line" | grep -Eiq "DOWN|PRESS"; then echo "1" > "$detection_result_file" exit 0 fi done < "$KEY_FIFO" ) & local detection_pid=$! if [ "$timeout_seconds" -gt 0 ]; then ( sleep "$timeout_seconds" if kill -0 "$detection_pid" 2>/dev/null; then kill "$detection_pid" 2>/dev/null echo "2" > "$detection_result_file" fi ) & local timeout_pid=$! wait "$detection_pid" 2>/dev/null kill "$timeout_pid" 2>/dev/null wait "$timeout_pid" 2>/dev/null else wait "$detection_pid" 2>/dev/null fi if [ -f "$detection_result_file" ]; then local result=$(cat "$detection_result_file") rm -f "$detection_result_file" return "$result" fi rm -f "$detection_result_file" return 2 } handle_choice() { local question="$1" local choice_yes="${2:-是}" local choice_no="${3:-否}" local timeout_seconds="${4:-10}" ui_print " " ui_print "-----------------------------------------------------------" ui_print "- ${question}" ui_print "- [ 音量加(+) ]: ${choice_yes}" ui_print "- [ 音量减(-) ]: ${choice_no}" ui_print "- [ ${timeout_seconds}秒内未选择将默认选择: ${choice_yes} ]" timeout 0.1 getevent -c 1 >/dev/null 2>&1 start_key_listener volume_key_detection "$timeout_seconds" local result=$? stop_key_listener if [ "$result" -eq 0 ]; then ui_print " => 您选择了: ${choice_yes}" return 0 elif [ "$result" -eq 1 ]; then ui_print " => 您选择了: ${choice_no}" return 1 else ui_print " => 超时未选择，默认选择: ${choice_yes}" return 0 fi } ui_print " " ui_print "===========================================================" ui_print "== Box for Magisk/KernelSU/APatch 安装程序 ==" ui_print "===========================================================" if handle_choice "是否需要下载内核或数据文件？" "是，进行下载" "否，全部跳过"; then if handle_choice "是否使用镜像加速接下来的下载？" "使用加速" "直接下载"; then ui_print "- 已启用镜像加速。" sed -i 's/use_ghproxy=.*/use_ghproxy="true"/' /data/adb/box/settings.ini else ui_print "- 已禁用镜像加速。" sed -i 's/use_ghproxy=.*/use_ghproxy="false"/' /data/adb/box/settings.ini fi COMPONENTS_TO_DOWNLOAD="" if handle_choice "是否需要自定义下载内容？" "自定义" "一键下载所有组件"; then ui_print "- 进入自定义下载..." if handle_choice "是否下载 GeoX 数据文件 (geoip/geosite)？" "下载" "跳过"; then COMPONENTS_TO_DOWNLOAD="$COMPONENTS_TO_DOWNLOAD geox" fi if handle_choice "是否下载实用工具 (yq, curl)？" "下载" "跳过"; then COMPONENTS_TO_DOWNLOAD="$COMPONENTS_TO_DOWNLOAD utils" fi ui_print " " ui_print "-----------------------------------------------------------" ui_print "- 请选择您需要下载的内核:" if handle_choice " - 下载 sing-box 内核？" "下载" "跳过"; then COMPONENTS_TO_DOWNLOAD="$COMPONENTS_TO_DOWNLOAD sing-box" fi if handle_choice " - 下载 mihomo 内核？" "下载" "跳过"; then COMPONENTS_TO_DOWNLOAD="$COMPONENTS_TO_DOWNLOAD mihomo" fi if handle_choice " - 下载 mihomo_smart (带Smart策略组) 内核？（与mihomo冲突，请勿同时下载）" "下载" "跳过"; then COMPONENTS_TO_DOWNLOAD="$COMPONENTS_TO_DOWNLOAD mihomo_smart" fi if handle_choice " - 下载 xray 内核？" "下载" "跳过"; then COMPONENTS_TO_DOWNLOAD="$COMPONENTS_TO_DOWNLOAD xray" fi if handle_choice " - 下载 v2fly 内核？" "下载" "跳过"; then COMPONENTS_TO_DOWNLOAD="$COMPONENTS_TO_DOWNLOAD v2fly" fi if handle_choice " - 下载 hysteria 内核？" "下载" "跳过"; then COMPONENTS_TO_DOWNLOAD="$COMPONENTS_TO_DOWNLOAD hysteria" fi else ui_print "- 已选择一键下载所有组件。" COMPONENTS_TO_DOWNLOAD="geox utils sing-box mihomo xray v2fly hysteria" fi ui_print " " ui_print "===========================================================" ui_print "- 下载任务预览" ui_print "-----------------------------------------------------------" if [ -z "$COMPONENTS_TO_DOWNLOAD" ]; then ui_print " - 无任何下载任务。" else COMPONENTS_TO_DOWNLOAD=$(echo "$COMPONENTS_TO_DOWNLOAD" | sed 's/^ *//') ui_print " - 将要下载: ${COMPONENTS_TO_DOWNLOAD}" fi ui_print "===========================================================" if [ -n "$COMPONENTS_TO_DOWNLOAD" ]; then if handle_choice "是否开始执行以上下载任务？" "开始下载" "取消全部"; then ui_print "- 开始执行下载..." for component in $COMPONENTS_TO_DOWNLOAD; do case "$component" in geox) ui_print " -> 正在下载 GeoX..." /data/adb/box/scripts/box.tool upgeox_all ;; utils) ui_print " -> 正在下载 yq..." /data/adb/box/scripts/box.tool upyq ui_print " -> 正在下载 curl..." /data/adb/box/scripts/box.tool upcurl ;; *) ui_print " -> 正在下载内核: $component..." /data/adb/box/scripts/box.tool upkernel "$component" ;; esac done ui_print "- 所有下载任务已完成！" else ui_print "- 已取消所有下载任务。" fi fi else ui_print "- 已跳过所有下载步骤。" fi if [ "${backup_box}" = "true" ]; then ui_print " " ui_print "- 正在恢复用户配置和数据..." if [ -f "${temp_dir}/settings.ini" ]; then if [ -f "/data/adb/box/settings.ini" ]; then if handle_choice "检测到旧的 settings.ini，选择如何处理？" "覆盖（使用新版覆盖旧版）" "增量合并（仅把旧值写入新版已有键）"; then ui_print " - 已选择使用新版 settings.ini（不应用旧版设置）" else mv /data/adb/box/settings.ini /data/adb/box/settings.ini.new grep -E '^[a-zA-Z0-9_]+=' "${temp_dir}/settings.ini" | while IFS='=' read -r key value; do [ -z "${key}" ] && continue echo "${key}" | grep -qE '^[a-zA-Z0-9_]+' || continue if grep -q -E "^${key}=" "/data/adb/box/settings.ini.new"; then escaped_value=$(printf '%s' "${value}" | sed -e 's/[&\\#]/\\&/g') sed -i "s#^${key}=.*#${key}=${escaped_value}#" "/data/adb/box/settings.ini.new" fi done mv /data/adb/box/settings.ini.new /data/adb/box/settings.ini ui_print " - 已将用户自定义项增量合并至新版 settings.ini" fi else cp -f "${temp_dir}/settings.ini" "/data/adb/box/settings.ini" ui_print " - 已恢复 settings.ini" fi fi restore_config_dir() { config_dir="$1" if [ -d "${temp_dir}/${config_dir}" ]; then ui_print " - 恢复 ${config_dir} 目录配置" cp -af "${temp_dir}/${config_dir}/." "/data/adb/box/${config_dir}/" fi } for dir in mihomo xray v2fly sing-box hysteria; do restore_config_dir "$dir" done ui_print " - 恢复根目录配置文件" for conf_file in ap.list.cfg package.list.cfg gid.list.cfg crontab.cfg; do if [ -f "${temp_dir}/${conf_file}" ]; then cp -f "${temp_dir}/${conf_file}" "/data/adb/box/${conf_file}" fi done restore_binary() { local bin_path_fragment="$1" local target_path="/data/adb/box/bin/${bin_path_fragment}" local backup_path="${temp_dir}/bin/${bin_path_fragment}" if [ ! -f "${target_path}" ] && [ -f "${backup_path}" ]; then ui_print " - 恢复二进制文件: ${bin_path_fragment}" mkdir -p "$(dirname "${target_path}")" cp -f "${backup_path}" "${target_path}" chmod 755 "${target_path}" fi } for bin_item in curl yq xray sing-box v2fly hysteria mihomo; do restore_binary "$bin_item" done if [ -d "${temp_dir}/run" ]; then ui_print " - 恢复日志、pid等运行时文件" cp -af "${temp_dir}/run/." "/data/adb/box/run/" fi fi [ -z "$(find /data/adb/box/bin -type f -name '*' ! -name '*.bak')" ] && sed -Ei 's/^description=(\[.*][[:space:]]*)?/description=[ 😱 模块已安装但需手动下载内核 ] /g' $MODPATH/module.prop if [ "$KSU" = "true" ]; then sed -i "s/name=.*/name=Box for KernelSU/g" $MODPATH/module.prop elif [ "$APATCH" = "true" ]; then sed -i "s/name=.*/name=Box for APatch/g" $MODPATH/module.prop else sed -i "s/name=.*/name=Box for Magisk/g" $MODPATH/module.prop fi unzip -o "$ZIPFILE" 'webroot/*' -d "$MODPATH" >&2 ui_print "- 清理残留文件" rm -rf /data/adb/box/bin/.bin $MODPATH/box $MODPATH/box_service.sh if [ "$backup_box" = "true" ] && [ -n "$temp_dir" ] && [ -d "$temp_dir" ]; then ui_print " " if handle_choice "检测到更新残留备份文件，是否删除？" "删除备份" "保留备份"; then ui_print "- 正在删除备份: ${temp_dir}" rm -rf "${temp_dir}" ui_print "- 备份已删除" else ui_print "- 备份已保留在: ${temp_dir}" fi fi ui_print "- 安装完成，请重启设备。"box-debug/module.prop000077500000000000000000000005051516412072700151310ustar00rootroot00000000000000id=box_for_root name=Box for Magisk/KernelSU version=1.2.6 versionCode=20251106 author=boxproxy,taamarin description=📦 Box for Root - 为Android设备提供透明代理工具箱 🚀 支持clash、sing-box、v2ray、hysteria和xray等多种代理工具 updateJson=https://github.com/boxproxy/box/raw/master/update.jsonbox-debug/uninstall.sh000077500000000000000000000006041516412072700153070ustar00rootroot00000000000000#!/system/bin/sh box_data_dir="/data/adb/box" rm_data() { if [ ! -d "${box_data_dir}" ]; then exit 1 else rm -rf "${box_data_dir}" fi if [ -f "/data/adb/ksu/service.d/box_service.sh" ]; then rm -rf "/data/adb/ksu/service.d/box_service.sh" fi if [ -f "/data/adb/service.d/box_service.sh" ]; then rm -rf "/data/adb/service.d/box_service.sh" fi } rm_databox-debug/update.json000077500000000000000000000003251516412072700151170ustar00rootroot00000000000000{ "version": "1.2.6", "versionCode": "20251106", "zipUrl": "https://github.com/boxproxy/box/releases/download/1.2.6/box-1.2.6.zip", "changelog": "https://github.com/boxproxy/box/raw/master/CHANGELOG.md" } box-debug/webroot/000077500000000000000000000000001516412072700144205ustar00rootroot00000000000000box-debug/webroot/index.html000077500000000000000000000001361516412072700164200ustar00rootroot00000000000000